Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5cc973f0 authored by Colin Ian King's avatar Colin Ian King Committed by Martin K. Petersen
Browse files

scsi: aacraid: fix leak of data from stack back to userspace 



The fields sense_data_size and sense_data are unitialized garbage from
the stack and are being copied back to userspace.  Fix this leak of
stack information by ensuring they are zero'd.

Detected by CoverityScan, CID#1435473 ("Uninitialized scalar variable")

Fixes: 423400e6 ("scsi: aacraid: Include HBA direct interface")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Acked-by: default avatarDave Carroll <david.carroll@microsemi.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent b609b1c7

drivers/scsi/aacraid/commctrl.c

+2 −0
Original line number Diff line number Diff line
@@ -955,6 +955,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) 
			reply.srb_status = SRB_STATUS_SUCCESS;

			reply.scsi_status = 0;

			reply.data_xfer_length = byte_count;

			reply.sense_data_size = 0;

			memset(reply.sense_data, 0, AAC_SENSE_BUFFERSIZE);

		} else {

			reply.srb_status = err->service_response;

			reply.scsi_status = err->status;