averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-14 21:43:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
cd3c8abbdc4ea1c67db992da45e6fd39595d278d
linux-stable-mirror/drivers/scsi
T
History
Tom RixandGreg Kroah-Hartman 914473a070 scsi: sr: Do not leak information in ioctl 
[ Upstream commit faad6cebde ]

sr_ioctl.c uses this pattern:

  result = sr_do_ioctl(cd, &cgc);
  to-user = buffer[];
  kfree(buffer);
  return result;

Use of a buffer without checking leaks information. Check result and jump
over the use of buffer if there is an error.

  result = sr_do_ioctl(cd, &cgc);
  if (result)
    goto err;
  to-user = buffer[];
err:
  kfree(buffer);
  return result;

Additionally, initialize the buffer to zero.

This problem can be seen in the 2.4.0 kernel.

Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-27 14:38:58 +02:00
..
aacraid
…
aic7xxx
…
aic94xx
…
arcmsr
…
arm
…
be2iscsi
…
bfa
scsi: bfa: Replace snprintf() with sysfs_emit()
2022-04-13 20:59:02 +02:00
bnx2fc
scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
2022-02-08 18:34:11 +01:00
bnx2i
scsi: iscsi: Merge suspend fields
2022-04-27 14:38:56 +02:00
csiostor
…
cxgbi
scsi: iscsi: Merge suspend fields
2022-04-27 14:38:56 +02:00
cxlflash
…
device_handler
…
dpt
…
elx
scsi: elx: efct: Don't use GFP_KERNEL under spin lock
2022-02-01 17:27:07 +01:00
esas2r
…
fcoe
…
fnic
scsi: fnic: Fix a tracing statement
2022-04-08 14:23:33 +02:00
hisi_sas
scsi: hisi_sas: Limit users changing debugfs BIST count value
2022-04-13 20:59:07 +02:00
ibmvscsi
…
ibmvscsi_tgt
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
2022-04-20 09:34:15 +02:00
isci
…
libfc
scsi: libfc: Fix use after free in fc_exch_abts_resp()
2022-04-13 20:59:08 +02:00
libsas
scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
2022-04-08 14:22:54 +02:00
lpfc
scsi: lpfc: Fix queue failures when recovering from PCI parity error
2022-04-20 09:34:15 +02:00
megaraid
scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
2022-04-20 09:34:17 +02:00
mpi3mr
scsi: mpi3mr: Fix memory leaks
2022-04-13 20:59:05 +02:00
mpt3sas
scsi: mpt3sas: Fail reset operation if config request timed out
2022-04-20 09:34:17 +02:00
mvsas
scsi: mvsas: Add PCI ID of RocketRaid 2640
2022-04-20 09:34:17 +02:00
pcmcia
…
pm8001
scsi: pm80xx: Enable upper inbound, outbound queues
2022-04-20 09:34:11 +02:00
qedf
scsi: qedf: Change context reset messages to ratelimited
2022-02-16 12:56:13 +01:00
qedi
scsi: qedi: Fix failed disconnect handling
2022-04-27 14:38:57 +02:00
qla2xxx
scsi: qla2xxx: Add qla2x00_async_done() for async routines
2022-04-08 14:24:12 +02:00
qla4xxx
…
smartpqi
scsi: smartpqi: Fix kdump issue when controller is locked up
2022-04-13 20:59:04 +02:00
snic
…
sym53c8xx_2
…
ufs
scsi: ufs: core: scsi_get_lba() error fix
2022-04-27 14:38:51 +02:00
.gitignore
…
3w-9xxx.c
…
3w-9xxx.h
…
3w-sas.c
…
3w-sas.h
…
3w-xxxx.c
…
3w-xxxx.h
…
53c700_d.h_shipped
…
53c700.c
…
53c700.h
…
53c700.scr
…
a100u2w.c
…
a100u2w.h
…
a2091.c
…
a2091.h
…
a3000.c
…
a3000.h
…
a4000t.c
…
advansys.c
…
aha152x.c
scsi: aha152x: Fix aha152x_setup() __setup handler return value
2022-04-13 20:59:07 +02:00
aha152x.h
…
aha1542.c
…
aha1542.h
…
aha1740.c
…
aha1740.h
…
am53c974.c
…
atari_scsi.c
…
atp870u.c
…
atp870u.h
…
BusLogic.c
…
BusLogic.h
…
bvme6000_scsi.c
…
ch.c
…
constants.c
…
dc395x.c
…
dc395x.h
…
dmx3191d.c
…
dpt_i2o.c
…
dpti.h
…
esp_scsi.c
…
esp_scsi.h
…
fdomain_isa.c
…
fdomain_pci.c
…
fdomain.c
…
fdomain.h
…
FlashPoint.c
…
g_NCR5380.c
…
gvp11.c
…
gvp11.h
…
hosts.c
…
hpsa_cmd.h
…
hpsa.c
…
hpsa.h
…
hptiop.c
…
hptiop.h
…
imm.c
…
imm.h
…
initio.c
…
initio.h
…
ipr.c
…
ipr.h
…
ips.c
…
ips.h
…
iscsi_boot_sysfs.c
…
iscsi_tcp.c
…
iscsi_tcp.h
…
jazz_esp.c
…
Kconfig
…
lasi700.c
…
libiscsi_tcp.c
scsi: iscsi: Merge suspend fields
2022-04-27 14:38:56 +02:00
libiscsi.c
scsi: iscsi: Fix NOP handling during conn recovery
2022-04-27 14:38:56 +02:00
mac53c94.c
…
mac53c94.h
…
mac_esp.c
…
mac_scsi.c
…
Makefile
…
megaraid.c
…
megaraid.h
…
mesh.c
…
mesh.h
…
mvme16x_scsi.c
…
mvme147.c
…
mvme147.h
…
mvumi.c
…
mvumi.h
…
myrb.c
…
myrb.h
…
myrs.c
scsi: myrs: Fix crash in error case
2022-02-16 12:56:14 +01:00
myrs.h
…
ncr53c8xx.c
…
ncr53c8xx.h
…
NCR5380.c
…
NCR5380.h
…
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
…
nsp32.h
…
pmcraid.c
…
pmcraid.h
…
ppa.c
…
ppa.h
…
ps3rom.c
…
qla1280.c
…
qla1280.h
…
qlogicfas408.c
…
qlogicfas408.h
…
qlogicfas.c
…
qlogicpti.c
…
qlogicpti.h
…
raid_class.c
…
script_asm.pl
…
scsi_bsg.c
…
scsi_common.c
…
scsi_debug.c
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
2021-12-22 09:32:51 +01:00
scsi_debugfs.c
scsi: core: Show SCMD_LAST in text form
2022-01-27 11:05:22 +01:00
scsi_debugfs.h
…
scsi_devinfo.c
…
scsi_dh.c
…
scsi_error.c
scsi: core: sd: Add silence_suspend flag to suppress some PM messages
2022-04-08 14:22:54 +02:00
scsi_ioctl.c
…
scsi_lib_dma.c
…
scsi_lib.c
…
scsi_logging.c
…
scsi_logging.h
…
scsi_netlink.c
…
scsi_pm.c
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
2022-01-27 11:04:15 +01:00
scsi_priv.h
…
scsi_proc.c
…
scsi_sas_internal.h
…
scsi_scan.c
scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map()
2022-04-13 20:59:15 +02:00
scsi_sysctl.c
…
scsi_sysfs.c
scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
2021-12-01 09:04:50 +01:00
scsi_trace.c
…
scsi_transport_api.h
…
scsi_transport_fc.c
scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
2022-04-08 14:22:54 +02:00
scsi_transport_iscsi.c
scsi: iscsi: Release endpoint ID when its freed
2022-04-27 14:38:56 +02:00
scsi_transport_sas.c
…
scsi_transport_spi.c
…
scsi_transport_srp.c
…
scsi.c
scsi: core: Fix scsi_device_max_queue_depth()
2022-01-27 11:04:10 +01:00
scsi.h
…
scsicam.c
…
sd_dif.c
…
sd_zbc.c
…
sd.c
scsi: core: sd: Add silence_suspend flag to suppress some PM messages
2022-04-08 14:22:54 +02:00
sd.h
…
sense_codes.h
…
ses.c
…
sg.c
block: drop unused includes in <linux/genhd.h>
2022-03-16 14:23:46 +01:00
sgiwd93.c
…
sim710.c
…
sni_53c710.c
…
sr_ioctl.c
scsi: sr: Do not leak information in ioctl
2022-04-27 14:38:58 +02:00
sr_vendor.c
scsi: sr: Don't use GFP_DMA
2022-01-27 11:05:03 +01:00
sr.c
scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
2022-04-13 20:59:15 +02:00
sr.h
…
st_options.h
…
st.c
block: drop unused includes in <linux/genhd.h>
2022-03-16 14:23:46 +01:00
st.h
…
stex.c
…
storvsc_drv.c
…
sun3_scsi_vme.c
…
sun3_scsi.c
…
sun3x_esp.c
…
sun_esp.c
…
virtio_scsi.c
…
vmw_pvscsi.c
scsi: vmw_pvscsi: Set residual data length conditionally
2022-01-05 12:42:39 +01:00
vmw_pvscsi.h
…
wd33c93.c
…
wd33c93.h
…
wd719x.c
…
wd719x.h
…
xen-scsifront.c
xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
2022-03-11 12:22:36 +01:00
zalon.c
…
zorro7xx.c
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
2022-04-13 20:59:15 +02:00
zorro_esp.c
…