Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754515AbdFWOEv (ORCPT ); Fri, 23 Jun 2017 10:04:51 -0400 Received: from mail-io0-f169.google.com ([209.85.223.169]:36284 "EHLO mail-io0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753966AbdFWOEt (ORCPT ); Fri, 23 Jun 2017 10:04:49 -0400 From: Seth Forshee To: Adaptec OEM Raid Solutions , "James E.J. Bottomley" , "Martin K. Petersen" Cc: Seth Forshee , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace Date: Fri, 23 Jun 2017 09:04:22 -0500 Message-Id: <20170623140422.30320-1-seth.forshee@canonical.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1319 Lines: 34 Both aac_send_raw_srb() and aac_get_hba_info() may copy stack allocated structs to userspace without initializing all members of these structs. Clear out this memory to prevent information leaks. Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface") Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl") Signed-off-by: Seth Forshee --- drivers/scsi/aacraid/commctrl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index d2f8d5954840..476ada6e39d0 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -950,6 +950,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; struct aac_srb_reply reply; + memset(&reply, 0, sizeof(reply)); reply.status = ST_OK; if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { /* fast response */ @@ -1019,6 +1020,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) { struct aac_hba_info hbainfo; + memset(&hbainfo, 0, sizeof(hbainfo)); hbainfo.adapter_number = (u8) dev->id; hbainfo.system_io_bus_number = dev->pdev->bus->number; hbainfo.device_number = (dev->pdev->devfn >> 3); -- 2.11.0