From nobody Mon May 11 08:30:23 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 832D6C433F5 for ; Sat, 9 Apr 2022 14:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242358AbiDIOyN (ORCPT ); Sat, 9 Apr 2022 10:54:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237146AbiDIOyI (ORCPT ); Sat, 9 Apr 2022 10:54:08 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 4DAA213D77 for ; Sat, 9 Apr 2022 07:51:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1649515918; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=t/bg9kn7ROahCSJyzfOEtwvtDCZszZoWTbNGij2GrjE=; b=WIn2RwJ+6s6g0PgtqNJIaGlqmHd/zV8vIuqysfyp3wN8v4yqTnhbYNl4rxyxsexHjj4rNi ySzlTOcL5FngQ9aRexdNRkDJKcuhIZtcAMyYSMgal9804Ui99LfQeDelaoreM22JsdY4SW EqjbNtmV5HABmQUnNAqtHjLTmKEqvTs= Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-591-hSMJZus7NGuvlFYTGrM01g-1; Sat, 09 Apr 2022 10:51:56 -0400 X-MC-Unique: hSMJZus7NGuvlFYTGrM01g-1 Received: by mail-qt1-f198.google.com with SMTP id c19-20020ac85a93000000b002ed12018ec4so749934qtc.11 for ; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=t/bg9kn7ROahCSJyzfOEtwvtDCZszZoWTbNGij2GrjE=; b=vbcxOB0KWuONAO7UP2KcO2mQKFdpUBAftic0TbDaKb+LZzrRhiv1tE3Ngk1/yIrIDf l7dJECSdeakxlbOr0dAGT3Yd5w8OGxgN9Dqu8ZjlTCtW+x+OOMVqeCY2eOPCYO9WFZLF nL/ihAtEsj77bLs54mDWDq8FT7hTamDUTRecAjIizQ+cEvGFFMctzNDR9JkV0ufa19HO n70yOYcn+3psPuFwFW/s8UuZhqx9cjUm4jMd92bZebwg6E1cFaD/aSkDlcIk00j7/e4b Evky8eHFz/Dp5rH1DdvmkuMaQya1DQkBWMIm6mxkN+y7IQpE+9oKIDN+uL9fSN1agO2T 94Tg== X-Gm-Message-State: AOAM533YedFbJnr3Ck+Sxj6eFrGQuIbF6lIyIITZTkMy1O15tYgsOfz2 7zKtD8vIILvx/eUwDpp+J4dkGkYwUmN9HXSU2MuoyEKrg2lTN4fV/85PeZJ++b6ioYhjq0uCCXa piY+9BZHAPiPz3FFpV90PTaP5 X-Received: by 2002:a05:620a:2544:b0:680:a53b:ec1a with SMTP id s4-20020a05620a254400b00680a53bec1amr16685995qko.544.1649515916289; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwGn6fJ9jRuJMb+wl3Tw8IkHfFNGvG+cEzqACp3UVw8jPRAuuFK+9VOOBkb8ed4Kksz+lzgVw== X-Received: by 2002:a05:620a:2544:b0:680:a53b:ec1a with SMTP id s4-20020a05620a254400b00680a53bec1amr16685978qko.544.1649515916047; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) Received: from dell-per740-01.7a2m.lab.eng.bos.redhat.com (nat-pool-bos-t.redhat.com. [66.187.233.206]) by smtp.gmail.com with ESMTPSA id a23-20020a05620a16d700b0067e98304705sm14845602qkn.89.2022.04.09.07.51.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 09 Apr 2022 07:51:55 -0700 (PDT) From: Tom Rix To: tim@cyberelk.net, axboe@kernel.dk, jejb@linux.ibm.com, martin.petersen@oracle.com, nathan@kernel.org, ndesaulniers@google.com Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, llvm@lists.linux.dev, Tom Rix Subject: [PATCH] security: do not leak information in ioctl Date: Sat, 9 Apr 2022 10:51:37 -0400 Message-Id: <20220409145137.67592-1-trix@redhat.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" clang static analysis reports this representative issue pcd.c:832:22: warning: Assigned value is garbage or undefined tochdr->cdth_trk0 =3D buffer[2]; ^ ~~~~~~~~~ If the call to pcd_atapi fails, buffer is an unknown state. Passing an unknown buffer back to the user can leak information and is a security risk. Check before returning this buffer to the user. The per-case variables cmd and buffer are common. Change their scope to function level. Change colliding parameter name cmd to request. Cleanup whitespace pcd.c comment /* the audio_ioctl stuff is adapted from sr_ioctl.c */ Shows there is a similar problem in sr_ioctl.c sr_ioctl.c uses this pattern result =3D sr_do_ioctl(cd, &cgc); to-user =3D buffer[]; kfree(buffer); return result; Check result and jump over the use of buffer if there is an error. result =3D sr_do_ioctl(cd, &cgc); if (result) goto err; to-user =3D buffer[]; err: kfree(buffer); return result; Additionally initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel However this scm only goes back as far as 2.6.12 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tom Rix --- drivers/block/paride/pcd.c | 87 +++++++++++++++++--------------------- drivers/scsi/sr_ioctl.c | 15 +++++-- 2 files changed, 50 insertions(+), 52 deletions(-) diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c index f462ad67931a..2315918e3647 100644 --- a/drivers/block/paride/pcd.c +++ b/drivers/block/paride/pcd.c @@ -810,67 +810,56 @@ static void do_pcd_read_drq(void) =20 /* the audio_ioctl stuff is adapted from sr_ioctl.c */ =20 -static int pcd_audio_ioctl(struct cdrom_device_info *cdi, unsigned int cmd= , void *arg) +static int pcd_audio_ioctl(struct cdrom_device_info *cdi, unsigned int req= uest, void *arg) { struct pcd_unit *cd =3D cdi->handle; + char cmd[12] =3D { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, 0, 0= , 0 }; + char buffer[32] =3D {}; =20 - switch (cmd) { - + switch (request) { case CDROMREADTOCHDR: + { + struct cdrom_tochdr *tochdr =3D + (struct cdrom_tochdr *) arg; =20 - { - char cmd[12] =3D - { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, - 0, 0, 0 }; - struct cdrom_tochdr *tochdr =3D - (struct cdrom_tochdr *) arg; - char buffer[32]; - int r; - - r =3D pcd_atapi(cd, cmd, 12, buffer, "read toc header"); + if (pcd_atapi(cd, cmd, 12, buffer, "read toc header")) + return -EIO; =20 - tochdr->cdth_trk0 =3D buffer[2]; - tochdr->cdth_trk1 =3D buffer[3]; + tochdr->cdth_trk0 =3D buffer[2]; + tochdr->cdth_trk1 =3D buffer[3]; =20 - return r ? -EIO : 0; - } + return 0; + } =20 case CDROMREADTOCENTRY: - - { - char cmd[12] =3D - { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, - 0, 0, 0 }; - - struct cdrom_tocentry *tocentry =3D - (struct cdrom_tocentry *) arg; - unsigned char buffer[32]; - int r; - - cmd[1] =3D - (tocentry->cdte_format =3D=3D CDROM_MSF ? 0x02 : 0); - cmd[6] =3D tocentry->cdte_track; - - r =3D pcd_atapi(cd, cmd, 12, buffer, "read toc entry"); - - tocentry->cdte_ctrl =3D buffer[5] & 0xf; - tocentry->cdte_adr =3D buffer[5] >> 4; - tocentry->cdte_datamode =3D - (tocentry->cdte_ctrl & 0x04) ? 1 : 0; - if (tocentry->cdte_format =3D=3D CDROM_MSF) { - tocentry->cdte_addr.msf.minute =3D buffer[9]; - tocentry->cdte_addr.msf.second =3D buffer[10]; - tocentry->cdte_addr.msf.frame =3D buffer[11]; - } else - tocentry->cdte_addr.lba =3D - (((((buffer[8] << 8) + buffer[9]) << 8) - + buffer[10]) << 8) + buffer[11]; - - return r ? -EIO : 0; + { + struct cdrom_tocentry *tocentry =3D + (struct cdrom_tocentry *) arg; + + cmd[1] =3D (tocentry->cdte_format =3D=3D CDROM_MSF ? 0x02 : 0); + cmd[6] =3D tocentry->cdte_track; + + if (pcd_atapi(cd, cmd, 12, buffer, "read toc entry")) + return -EIO; + + tocentry->cdte_ctrl =3D buffer[5] & 0xf; + tocentry->cdte_adr =3D buffer[5] >> 4; + tocentry->cdte_datamode =3D + (tocentry->cdte_ctrl & 0x04) ? 1 : 0; + if (tocentry->cdte_format =3D=3D CDROM_MSF) { + tocentry->cdte_addr.msf.minute =3D buffer[9]; + tocentry->cdte_addr.msf.second =3D buffer[10]; + tocentry->cdte_addr.msf.frame =3D buffer[11]; + } else { + tocentry->cdte_addr.lba =3D + (((((buffer[8] << 8) + buffer[9]) << 8) + + buffer[10]) << 8) + buffer[11]; } =20 - default: + return 0; + } =20 + default: return -ENOSYS; } } diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index ddd00efc4882..fbdb5124d7f7 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -41,7 +41,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; =20 - buffer =3D kmalloc(32, GFP_KERNEL); + buffer =3D kzalloc(32, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -55,10 +55,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction =3D DMA_FROM_DEVICE; =20 result =3D sr_do_ioctl(cd, &cgc); + if (result) + goto err; =20 tochdr->cdth_trk0 =3D buffer[2]; tochdr->cdth_trk1 =3D buffer[3]; =20 +err: kfree(buffer); return result; } @@ -71,7 +74,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; =20 - buffer =3D kmalloc(32, GFP_KERNEL); + buffer =3D kzalloc(32, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -86,6 +89,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction =3D DMA_FROM_DEVICE; =20 result =3D sr_do_ioctl(cd, &cgc); + if (result) + goto err; =20 tocentry->cdte_ctrl =3D buffer[5] & 0xf; tocentry->cdte_adr =3D buffer[5] >> 4; @@ -98,6 +103,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cd= i, tocentry->cdte_addr.lba =3D (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; =20 +err: kfree(buffer); return result; } @@ -384,7 +390,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cd= rom_mcn *mcn) { Scsi_CD *cd =3D cdi->handle; struct packet_command cgc; - char *buffer =3D kmalloc(32, GFP_KERNEL); + char *buffer =3D kzalloc(32, GFP_KERNEL); int result; =20 if (!buffer) @@ -400,10 +406,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct = cdrom_mcn *mcn) cgc.data_direction =3D DMA_FROM_DEVICE; cgc.timeout =3D IOCTL_TIMEOUT; result =3D sr_do_ioctl(cd, &cgc); + if (result) + goto err; =20 memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] =3D 0; =20 +err: kfree(buffer); return result; } --=20 2.27.0