From: Tom Rix trix@redhat.com

mainline inclusion from mainline-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

sr_ioctl.c uses this pattern:

result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result;

Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error.

result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result;

Additionally, initialize the buffer to zero.

This problem can be seen in the 2.4.0 kernel.

Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Tom Rix trix@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com

Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- v1->v2: Correct commit message. drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 4c1de11e69fb..0808217f2d7b 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer;

- buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM;

@@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE;

result = sr_do_ioctl(cd, &cgc); + if (result) + goto err;

tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3];

+err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer;

- buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM;

@@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE;

result = sr_do_ioctl(cd, &cgc); + if (result) + goto err;

tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11];

+err: kfree(buffer); return result; } @@ -388,7 +394,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result;

if (!buffer) @@ -404,10 +410,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err;

memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0;

+err: kfree(buffer); return result; }