[Linux-kernel-mentees] [PATCH] scsi/megaraid: Prevent kernel-infoleak in kioc_to_mimd()
From: Peilin Ye <hidden>
Date: 2020-07-27 21:04:36
Also in:
linux-scsi, lkml
Subsystem:
megaraid scsi/sas drivers, scsi subsystem, the rest · Maintainers:
Kashyap Desai, Sumit Saxena, Shivasharan S, Chandrakanth patil, "James E.J. Bottomley", "Martin K. Petersen", Linus Torvalds
hinfo_to_cinfo() does no operation on `cinfo` when `hinfo` is NULL,
causing kioc_to_mimd() to copy uninitialized stack memory to userspace.
Fix it by initializing `cinfo` with memset().
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Dan Carpenter <redacted>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Peilin Ye <redacted>
---
drivers/scsi/megaraid/megaraid_mm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index 8df53446641a..9df0e6b253a8 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c@@ -816,6 +816,8 @@ kioc_to_mimd(uioc_t *kioc, mimd_t __user *mimd) case MEGAIOC_QADAPINFO: + memset(&cinfo, 0, sizeof(cinfo)); + hinfo = (mraid_hba_info_t *)(unsigned long) kioc->buf_vaddr;
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees