scsi: sr: Do not leak information in ioctl
mainline inclusion from mainline-v5.18-rc4 commit faad6ceb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=faad6cebded8e0fd902b672f220449b93db479eb -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4 ("Linux-2.6.12-rc2") Reviewed-by:Christoph Hellwig <hch@lst.de> Signed-off-by:
Tom Rix <trix@redhat.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5eba ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by:
Li Lingfeng <lilingfeng3@huawei.com>
Loading
Please sign in to comment