scsi: arcmsr: Avoid over-read of sense buffer
authorKees Cook <keescook@chromium.org>
Wed, 16 Jun 2021 21:24:28 +0000 (14:24 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Sat, 19 Jun 2021 03:26:33 +0000 (23:26 -0400)
commit86a6a0bdbe2beb4cc7bc80eccd835b62a1f0c364
tree29b98b480005668357cfac89dd9798d6eb7cb211
parent4ab293c2809efa1499c3290ff007d98a9ee2fab2
scsi: arcmsr: Avoid over-read of sense buffer

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

pcmd->sense_buffer is 96 bytes, and was being manually zero-filled.
However, struct SENSE_DATA is 18 bytes, with ccb->arcmsr_cdb.SenseData only
being 15 bytes, resulting in a 3 byte over-read.

Copy only the contents of ccb->arcmsr_cdb.SenseData and zero fill the
remainder, avoiding potential over-reads.

Link: https://lore.kernel.org/r/20210616212428.1726958-1-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/arcmsr/arcmsr_hba.c