scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (9793679d) · Commits · e / devices / android_kernel_xiaomi_markw

commit 3e0097499839e0fe3af380410eababe5a47c4cf9 upstream. When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is returned; the remaining part will then contain stale kernel memory information. This patch zeroes out the entire table to avoid this issue. Signed-off-by:

Hannes Reinecke <hare@suse.com> Reviewed-by:

Bart Van Assche <bart.vanassche@wdc.com> Reviewed-by:

Christoph Hellwig <hch@lst.de> Reviewed-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/scsi/sg.c

+2 −3

Original line number	Original line	Diff line number	Diff line
	@@ -865,7 +865,6 @@ sg_fill_request_table(Sg_fd sfp, sg_req_info_t rinfo)
	list_for_each_entry(srp, &sfp->rq_list, entry) {		list_for_each_entry(srp, &sfp->rq_list, entry) {
	if (val > SG_MAX_QUEUE)		if (val > SG_MAX_QUEUE)
	break;		break;
	memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
	rinfo[val].req_state = srp->done + 1;		rinfo[val].req_state = srp->done + 1;
	rinfo[val].problem =		rinfo[val].problem =
	srp->header.masked_status &		srp->header.masked_status &
	@@ -1082,7 +1081,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
	else {		else {
	sg_req_info_t *rinfo;		sg_req_info_t *rinfo;

	rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,		rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
	GFP_KERNEL);		GFP_KERNEL);
	if (!rinfo)		if (!rinfo)
	return -ENOMEM;		return -ENOMEM;