From: Peilin Ye <yepeilin.cs@gmail.com>

Date: Fri, 2 Oct 2020 10:22:23 -0400

Subject: [PATCH] block/scsi-ioctl: Fix kernel-infoleak in

 scsi_put_cdrom_generic_arg()

Git-commit: 6d53a9fe5a1983490bc14b3a64d49fabb4ccc651

Patch-mainline: v5.9-rc1

References: git-fixes

scsi_put_cdrom_generic_arg() is copying uninitialized stack memory to

userspace, since the compiler may leave a 3-byte hole in the middle of

`cgc32`. Fix it by adding a padding field to `struct

compat_cdrom_generic_command`.

Cc: stable@vger.kernel.org

Fixes: f3ee6e63a9df ("compat_ioctl: move CDROM_SEND_PACKET handling into scsi")

Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>

Suggested-by: Arnd Bergmann <arnd@arndb.de>

Reported-by: syzbot+85433a479a646a064ab3@syzkaller.appspotmail.com

Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>

Signed-off-by: Jens Axboe <axboe@kernel.dk>

Acked-by: Hannes Reinecke <hare@suse.com>

---

 block/scsi_ioctl.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c

index ef722f04f88a..72108404718f 100644

--- a/block/scsi_ioctl.c

+++ b/block/scsi_ioctl.c

@@ -651,6 +651,7 @@ struct compat_cdrom_generic_command {

 	compat_int_t	stat;

 	compat_caddr_t	sense;

 	unsigned char	data_direction;

+	unsigned char	pad[3];

 	compat_int_t	quiet;

 	compat_int_t	timeout;

 	compat_caddr_t	reserved[1];

-- 

2.29.2