Commit a02b4525 authored by Daniil Stas's avatar Daniil Stas Committed by Chen Ridong
Browse files

hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur 

stable inclusion
from stable-v6.6.72
commit 53e25b10a28edaf8c2a1d3916fd8929501a50dfc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6R2
CVE: CVE-2025-21656

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=53e25b10a28edaf8c2a1d3916fd8929501a50dfc



--------------------------------

[ Upstream commit 82163d63ae7a4c36142cd252388737205bb7e4b9 ]

scsi_execute_cmd() function can return both negative (linux codes) and
positive (scsi_cmnd result field) error codes.

Currently the driver just passes error codes of scsi_execute_cmd() to
hwmon core, which is incorrect because hwmon only checks for negative
error codes. This leads to hwmon reporting uninitialized data to
userspace in case of SCSI errors (for example if the disk drive was
disconnected).

This patch checks scsi_execute_cmd() output and returns -EIO if it's
error code is positive.

Fixes: 5b46903d ("hwmon: Driver for disk and solid state drives with temperature sensors")
Signed-off-by: default avatarDaniil Stas <daniil.stas@posteo.net>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Chris Healy <cphealy@gmail.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: linux-kernel@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Cc: linux-ide@vger.kernel.org
Cc: linux-hwmon@vger.kernel.org
Link: https://lore.kernel.org/r/20250105213618.531691-1-daniil.stas@posteo.net


[groeck: Avoid inline variable declaration for portability]
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent 6eb132ae

drivers/hwmon/drivetemp.c

+6 −2
Original line number Diff line number Diff line
@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, 
{

	u8 scsi_cmd[MAX_COMMAND_SIZE];

	enum req_op op;

	int err;



	memset(scsi_cmd, 0, sizeof(scsi_cmd));

	scsi_cmd[0] = ATA_16;
@@ -192,8 +193,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, 
	scsi_cmd[12] = lba_high;

	scsi_cmd[14] = ata_command;



	return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,

	err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,

			       ATA_SECT_SIZE, HZ, 5, NULL);

	if (err > 0)

		err = -EIO;

	return err;

}



static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,