[SRU][J][PATCH 1/1] hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

[Rickey Castillo]

From: Daniil Stas <daniil.stas at posteo.net>

scsi_execute_cmd() function can return both negative (linux codes) and
positive (scsi_cmnd result field) error codes.

Currently the driver just passes error codes of scsi_execute_cmd() to
hwmon core, which is incorrect because hwmon only checks for negative
error codes. This leads to hwmon reporting uninitialized data to
userspace in case of SCSI errors (for example if the disk drive was
disconnected).

This patch checks scsi_execute_cmd() output and returns -EIO if it's
error code is positive.

Fixes: 5b46903d8bf37 ("hwmon: Driver for disk and solid state drives with temperature sensors")
Signed-off-by: Daniil Stas <daniil.stas at posteo.net>
Cc: Guenter Roeck <linux at roeck-us.net>
Cc: Chris Healy <cphealy at gmail.com>
Cc: Linus Walleij <linus.walleij at linaro.org>
Cc: Martin K. Petersen <martin.petersen at oracle.com>
Cc: Bart Van Assche <bvanassche at acm.org>
Cc: linux-kernel at vger.kernel.org
Cc: linux-scsi at vger.kernel.org
Cc: linux-ide at vger.kernel.org
Cc: linux-hwmon at vger.kernel.org
Link: https://lore.kernel.org/r/20250105213618.531691-1-daniil.stas@posteo.net
[groeck: Avoid inline variable declaration for portability]
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
(backported from commit 82163d63ae7a4c36142cd252388737205bb7e4b9)
[rickey.castillo: fixed conflict in drivetemp.c due to upstream API migration.
 Kernel 5.15 still uses scsi_execute_req() and data_dir variables instead of
 the newer scsi_execute_cmd() and enum req_op.]
CVE-2025-21656
Signed-off-by: Rickey Castillo <rickey.castillo.valenzuela at canonical.com>
---
 drivers/hwmon/drivetemp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c
index 5bac2b0fc7bb..b4fea004b0b4 100644
--- a/drivers/hwmon/drivetemp.c
+++ b/drivers/hwmon/drivetemp.c
@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
 {
 	u8 scsi_cmd[MAX_COMMAND_SIZE];
 	int data_dir;
+	int err;
 
 	memset(scsi_cmd, 0, sizeof(scsi_cmd));
 	scsi_cmd[0] = ATA_16;
@@ -192,9 +193,12 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
 	scsi_cmd[12] = lba_high;
 	scsi_cmd[14] = ata_command;
 
-	return scsi_execute_req(st->sdev, scsi_cmd, data_dir,
+	err = scsi_execute_req(st->sdev, scsi_cmd, data_dir,
 				st->smartdata, ATA_SECT_SIZE, NULL, HZ, 5,
 				NULL);
+	if (err > 0)
+		err = -EIO;
+	return err;
 }
 
 static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,
-- 
2.53.0