Commit 6fc2586d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fix from James Bottomley:
 "One fix for an information leak caused by copying a buffer to
  userspace without checking for error first in the sr driver"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: sr: Do not leak information in ioctl
parents b51bd23c faad6ceb

drivers/scsi/sr_ioctl.c

+12 −3
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, 
	int result;

	unsigned char *buffer;



	buffer = kmalloc(32, GFP_KERNEL);

	buffer = kzalloc(32, GFP_KERNEL);

	if (!buffer)

		return -ENOMEM;
@@ -55,10 +55,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, 
	cgc.data_direction = DMA_FROM_DEVICE;



	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	tochdr->cdth_trk0 = buffer[2];

	tochdr->cdth_trk1 = buffer[3];



err:

	kfree(buffer);

	return result;

}
@@ -71,7 +74,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
	int result;

	unsigned char *buffer;



	buffer = kmalloc(32, GFP_KERNEL);

	buffer = kzalloc(32, GFP_KERNEL);

	if (!buffer)

		return -ENOMEM;
@@ -86,6 +89,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
	cgc.data_direction = DMA_FROM_DEVICE;



	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	tocentry->cdte_ctrl = buffer[5] & 0xf;

	tocentry->cdte_adr = buffer[5] >> 4;
@@ -98,6 +103,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, 
		tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8)

			+ buffer[10]) << 8) + buffer[11];



err:

	kfree(buffer);

	return result;

}
@@ -384,7 +390,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) 
{

	Scsi_CD *cd = cdi->handle;

	struct packet_command cgc;

	char *buffer = kmalloc(32, GFP_KERNEL);

	char *buffer = kzalloc(32, GFP_KERNEL);

	int result;



	if (!buffer)
@@ -400,10 +406,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) 
	cgc.data_direction = DMA_FROM_DEVICE;

	cgc.timeout = IOCTL_TIMEOUT;

	result = sr_do_ioctl(cd, &cgc);

	if (result)

		goto err;



	memcpy(mcn->medium_catalog_number, buffer + 9, 13);

	mcn->medium_catalog_number[13] = 0;



err:

	kfree(buffer);

	return result;

}