ACK: [PATCH 1/1][Zesty] UBUNTU: SAUCE: scsi: aacraid: Don't copy uninitialized stack memory to userspace

[Colin Ian King]

On 23/06/17 15:24, Seth Forshee wrote:
> BugLink: http://bugs.launchpad.net/bugs/1700077
> 
> Both aac_send_raw_srb() and aac_get_hba_info() may copy stack
> allocated structs to userspace without initializing all members
> of these structs. Clear out this memory to prevent information
> leaks.
> 
> Signed-off-by: Seth Forshee <seth.forshee at canonical.com>
> ---
>  drivers/scsi/aacraid/commctrl.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
> index 106b9332f718..176220ae6961 100644
> --- a/drivers/scsi/aacraid/commctrl.c
> +++ b/drivers/scsi/aacraid/commctrl.c
> @@ -949,6 +949,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
>  			&((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err;
>  		struct aac_srb_reply reply;
>  
> +		memset(&reply, 0, sizeof(reply));
>  		reply.status = ST_OK;
>  		if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) {
>  			/* fast response */
> @@ -1018,6 +1019,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg)
>  {
>  	struct aac_hba_info hbainfo;
>  
> +	memset(&hbainfo, 0, sizeof(hbainfo));
>  	hbainfo.adapter_number		= (u8) dev->id;
>  	hbainfo.system_io_bus_number	= dev->pdev->bus->number;
>  	hbainfo.device_number		= (dev->pdev->devfn >> 3);
> 

Thanks Seth, I'm glad you spotted a second leak there as well.

Acked-by: Colin Ian King <colin.king at canonical.com>