diff mbox

[v2] scsi: megasas: initialise local configuration data buffer

Message ID 1464178304-12831-1-git-send-email-ppandit@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Prasad Pandit May 25, 2016, 12:11 p.m. UTC 
From: Prasad J Pandit <pjp@fedoraproject.org>

When reading MegaRAID SAS controller configuration via MegaRAID
Firmware Interface(MFI) commands, routine megasas_dcmd_cfg_read
uses an uninitialised local data buffer. Initialise this buffer
to avoid stack information leakage.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/scsi/megasas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Update as per
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04402.html

Comments

Prasad Pandit June 7, 2016, 6:51 a.m. UTC | #1 
+-- On Wed, 25 May 2016, P J P wrote --+
| Update as per
|   -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04402.html
| 
| diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
| index dcbd3e1..bf642d4 100644
| --- a/hw/scsi/megasas.c
| +++ b/hw/scsi/megasas.c
| @@ -1293,7 +1293,7 @@ static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
|  
|  static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
|  {
| -    uint8_t data[4096];
| +    uint8_t data[4096] = { 0 };
|      struct mfi_config_data *info;
|      int num_pd_disks = 0, array_offset, ld_offset;
|      BusChild *kid;

Ping..!

This one came with couple of others,

  -> https://patchwork.ozlabs.org/patch/626089/
  -> https://patchwork.ozlabs.org/patch/626152/
  -> https://patchwork.ozlabs.org/patch/626151/

Are these queued? (just checking)

Thank you. 
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
Paolo Bonzini June 7, 2016, 7:53 a.m. UTC | #2 
On 07/06/2016 08:51, P J P wrote:
> +-- On Wed, 25 May 2016, P J P wrote --+
> | Update as per
> |   -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04402.html
> | 
> | diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> | index dcbd3e1..bf642d4 100644
> | --- a/hw/scsi/megasas.c
> | +++ b/hw/scsi/megasas.c
> | @@ -1293,7 +1293,7 @@ static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
> |  
> |  static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
> |  {
> | -    uint8_t data[4096];
> | +    uint8_t data[4096] = { 0 };
> |      struct mfi_config_data *info;
> |      int num_pd_disks = 0, array_offset, ld_offset;
> |      BusChild *kid;
> 
> Ping..!
> 
> This one came with couple of others,
> 
>   -> https://patchwork.ozlabs.org/patch/626089/
>   -> https://patchwork.ozlabs.org/patch/626152/
>   -> https://patchwork.ozlabs.org/patch/626151/
> 
> Are these queued? (just checking)

They are in already.  In particular this is commit
d37af740730dbbb93960cd318e040372d04d6dcf.

Paolo
Prasad Pandit June 7, 2016, 8:48 a.m. UTC | #3 
+-- On Tue, 7 Jun 2016, Paolo Bonzini wrote --+
| They are in already.  In particular this is commit
| d37af740730dbbb93960cd318e040372d04d6dcf.

Okay, thank you. (sorry to bother you)
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
diff mbox

Patch

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index dcbd3e1..bf642d4 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -1293,7 +1293,7 @@  static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
 
 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
 {
-    uint8_t data[4096];
+    uint8_t data[4096] = { 0 };
     struct mfi_config_data *info;
     int num_pd_disks = 0, array_offset, ld_offset;
     BusChild *kid;