Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 429296cc authored by Kees Cook's avatar Kees Cook Committed by Jens Axboe
Browse files

libata-scsi: Move sense buffers onto stack 



To support future compile-time sizeof() checks that will be able to
validate the length of sense buffers, this removes the only dynamically
allocated sense buffers in the tree by putting the 96 byte sense buffers
on the stack.

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Acked-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 4e178c17

drivers/ata/libata-scsi.c

+6 −12
Original line number Diff line number Diff line
@@ -597,8 +597,9 @@ static int ata_get_identity(struct ata_port *ap, struct scsi_device *sdev, 
int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)

{

	int rc = 0;

	u8 sensebuf[SCSI_SENSE_BUFFERSIZE];

	u8 scsi_cmd[MAX_COMMAND_SIZE];

	u8 args[4], *argbuf = NULL, *sensebuf = NULL;

	u8 args[4], *argbuf = NULL;

	int argsize = 0;

	enum dma_data_direction data_dir;

	struct scsi_sense_hdr sshdr;
@@ -610,10 +611,7 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) 
	if (copy_from_user(args, arg, sizeof(args)))

		return -EFAULT;



	sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);

	if (!sensebuf)

		return -ENOMEM;



	memset(sensebuf, 0, sizeof(sensebuf));

	memset(scsi_cmd, 0, sizeof(scsi_cmd));



	if (args[3]) {
@@ -685,7 +683,6 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) 
	 && copy_to_user(arg + sizeof(args), argbuf, argsize))

		rc = -EFAULT;

error:

	kfree(sensebuf);

	kfree(argbuf);

	return rc;

}
@@ -704,8 +701,9 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) 
int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)

{

	int rc = 0;

	u8 sensebuf[SCSI_SENSE_BUFFERSIZE];

	u8 scsi_cmd[MAX_COMMAND_SIZE];

	u8 args[7], *sensebuf = NULL;

	u8 args[7];

	struct scsi_sense_hdr sshdr;

	int cmd_result;
@@ -715,10 +713,7 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg) 
	if (copy_from_user(args, arg, sizeof(args)))

		return -EFAULT;



	sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);

	if (!sensebuf)

		return -ENOMEM;



	memset(sensebuf, 0, sizeof(sensebuf));

	memset(scsi_cmd, 0, sizeof(scsi_cmd));

	scsi_cmd[0]  = ATA_16;

	scsi_cmd[1]  = (3 << 1); /* Non-data */
@@ -769,7 +764,6 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg) 
	}



 error:

	kfree(sensebuf);

	return rc;

}