Commit 0f3528a7 authored by Tom Rix's avatar Tom Rix Committed by Li Lingfeng
Browse files

scsi: sr: Do not leak information in ioctl 

mainline inclusion
from mainline-v5.18-rc4
commit faad6ceb
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=faad6cebded8e0fd902b672f220449b93db479eb

--------------------------------

sr_ioctl.c uses this pattern:

  result = sr_do_ioctl(cd, &cgc);
  to-user = buffer[];
  kfree(buffer);
  return result;

Use of a buffer without checking leaks information. Check result and jump
over the use of buffer if there is an error.

  result = sr_do_ioctl(cd, &cgc);
  if (result)
    goto err;
  to-user = buffer[];
err:
  kfree(buffer);
  return result;

Additionally, initialize the buffer to zero.

This problem can be seen in the 2.4.0 kernel.

Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com


Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarTom Rix <trix@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>

Conflicts:
  drivers/scsi/sr_ioctl.c
[Commit aaff5eba ("scsi: remove the unchecked_isa_dma flag") remove
the unchecked_isa_dma flag]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 34c4be6c

drivers/scsi/sr_ioctl.c

+12 −3
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, 
	int result;

	unsigned char *buffer;



	buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	if (!buffer)

		return -ENOMEM;
@@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, 
	cgc.data_direction = DMA_FROM_DEVICE;



	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	tochdr->cdth_trk0 = buffer[2];

	tochdr->cdth_trk1 = buffer[3];



err:

	kfree(buffer);

	return result;

}
@@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
	int result;

	unsigned char *buffer;



	buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	if (!buffer)

		return -ENOMEM;
@@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
	cgc.data_direction = DMA_FROM_DEVICE;



	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	tocentry->cdte_ctrl = buffer[5] & 0xf;

	tocentry->cdte_adr = buffer[5] >> 4;
@@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
		tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8)

			+ buffer[10]) << 8) + buffer[11];



err:

	kfree(buffer);

	return result;

}
@@ -388,7 +394,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) 
{

	Scsi_CD *cd = cdi->handle;

	struct packet_command cgc;

	char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));

	int result;



	if (!buffer)
@@ -404,10 +410,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) 
	cgc.data_direction = DMA_FROM_DEVICE;

	cgc.timeout = IOCTL_TIMEOUT;

	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	memcpy(mcn->medium_catalog_number, buffer + 9, 13);

	mcn->medium_catalog_number[13] = 0;



err:

	kfree(buffer);

	return result;

}