diff mbox series

[v2] scsi: storvsc: Set correct data length for sending SCSI command without payload

Message ID 1737601642-7759-1-git-send-email-longli@linuxonhyperv.com (mailing list archive)
State Accepted
Headers show
Series [v2] scsi: storvsc: Set correct data length for sending SCSI command without payload | expand

Commit Message

Long Li Jan. 23, 2025, 3:07 a.m. UTC 
From: Long Li <longli@microsoft.com>

In StorVSC, payload->range.len is used to indicate if this SCSI command
carries payload. This data is allocated as part of the private driver
data by the upper layer and may get passed to lower driver uninitialized.

For example, the SCSI error handling mid layer may send TEST_UNIT_READY
or REQUEST_SENSE while reusing the buffer from a failed command. The
private data section may have stale data from the previous command.

If the SCSI command doesn't carry payload, the driver may use this value as
is for communicating with host, resulting in possible corruption.

Fix this by always initializing this value.

Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
Cc: stable@kernel.org
Tested-by: Roman Kisel <romank@linux.microsoft.com>
Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Long Li <longli@microsoft.com>

---

Changes:
v2: add details in comment section explaining why there might be uninitialized data in driver private section

 drivers/scsi/storvsc_drv.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Martin K. Petersen Feb. 4, 2025, 3:33 a.m. UTC | #1 
On Wed, 22 Jan 2025 19:07:22 -0800, longli@linuxonhyperv.com wrote:

> In StorVSC, payload->range.len is used to indicate if this SCSI command
> carries payload. This data is allocated as part of the private driver
> data by the upper layer and may get passed to lower driver uninitialized.
> 
> For example, the SCSI error handling mid layer may send TEST_UNIT_READY
> or REQUEST_SENSE while reusing the buffer from a failed command. The
> private data section may have stale data from the previous command.
> 
> [...]

Applied to 6.14/scsi-fixes, thanks!

[1/1] scsi: storvsc: Set correct data length for sending SCSI command without payload
      https://git.kernel.org/mkp/scsi/c/87c4b5e8a6b6
diff mbox series

Patch

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 7ceb982040a5..ca5e5c0aeabf 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1789,6 +1789,7 @@  static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
 
 	length = scsi_bufflen(scmnd);
 	payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
+	payload->range.len = 0;
 	payload_sz = 0;
 
 	if (scsi_sg_count(scmnd)) {