scsi: stex: Properly zero out the passthrough command structure

commit dd34162a122f517fa1b02d50562cfe46029dd78e upstream.

The passthrough structure is declared off of the stack, so it needs to be
set to zero before copied back to userspace to prevent any unintentional
data leakage.  Switch things to be statically allocated which will fill the
unused fields with 0 automatically.

Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com
Cc: stable@kernel.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: hdthky <hdthky0@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index 33287b6bdf0ef9c1788d89d269c680de0610ebec..159ffc2bb592f1b2d648e72df4f8d69317328803 100644 (file)
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -668,16 +668,17 @@ stex_queuecommand_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
                return 0;
        case PASSTHRU_CMD:
                if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) {
-                       struct st_drvver ver;
+                       const struct st_drvver ver = {
+                               .major = ST_VER_MAJOR,
+                               .minor = ST_VER_MINOR,
+                               .oem = ST_OEM,
+                               .build = ST_BUILD_VER,
+                               .signature[0] = PASSTHRU_SIGNATURE,
+                               .console_id = host->max_id - 1,
+                               .host_no = hba->host->host_no,
+                       };
                        size_t cp_len = sizeof(ver);
 
-                       ver.major = ST_VER_MAJOR;
-                       ver.minor = ST_VER_MINOR;
-                       ver.oem = ST_OEM;
-                       ver.build = ST_BUILD_VER;
-                       ver.signature[0] = PASSTHRU_SIGNATURE;
-                       ver.console_id = host->max_id - 1;
-                       ver.host_no = hba->host->host_no;
                        cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len);
                        cmd->result = sizeof(ver) == cp_len ?
                                DID_OK << 16 | COMMAND_COMPLETE << 8 :

diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 91bd749a02f7a2ee10e51e21da3c240e17a046cf..7738a055d95358b58e4ce3320039c3e31ef1e105 100644 (file)
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -204,7 +204,7 @@ static inline int scsi_get_resid(struct scsi_cmnd *cmd)
        for_each_sg(scsi_sglist(cmd), sg, nseg, __i)
 
 static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd,
-                                          void *buf, int buflen)
+                                          const void *buf, int buflen)
 {
        return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd),
                                   buf, buflen);