All of lore.kernel.org
 help / color / mirror / Atom feed
From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
To: linux-scsi@vger.kernel.org, martin.petersen@oracle.com
Cc: sathya.prakash@broadcom.com, ranjan.kumar@broadcom.com,
	sumit.saxena@broadcom.com, sweeti.vandure@broadcom.com,
	vishakhavc@google.com, ipylypiv@google.com,
	Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Subject: [PATCH v2 15/17] mpi3mr: zero out diagnostic buffer status memory
Date: Wed, 26 Aug 2026 02:34:09 +0530	[thread overview]
Message-ID: <20260825210411.301535-16-chandrakanth.patil@broadcom.com> (raw)
In-Reply-To: <20260825210411.301535-1-chandrakanth.patil@broadcom.com>

Memory allocated for the BSG diagnostic buffer status is not zero'd
before it is copied back to user space. Several fields in this
structure are reserved and never written by the driver. Use kzalloc
instead of kmalloc to zero out the allocated memory.

Fixes: 78b506984ebe ("scsi: mpi3mr: Add ioctl support for HDB")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
---
v2:
 - No changes from v1.
 drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index f5b48c95cf05..0cdcb8d236d3 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -1244,7 +1244,7 @@ static long mpi3mr_bsg_query_hdb(struct mpi3mr_ioc *mrioc,
 
 	length = (sizeof(*hbd_status) + ((MPI3MR_MAX_NUM_HDB - 1) *
 		    sizeof(*hbd_status_entry)));
-	hbd_status = kmalloc(length, GFP_KERNEL);
+	hbd_status = kzalloc(length, GFP_KERNEL);
 	if (!hbd_status)
 		return -ENOMEM;
 	hbd_status_entry = &hbd_status->entry[0];
-- 
2.52.0


  parent reply	other threads:[~2026-08-25 15:45 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-25 21:03 [PATCH v2 00/17] scsi: mpi3mr: Fix out-of-bounds accesses and reference leaks Chandrakanth Patil
2026-08-25 21:03 ` [PATCH v2 01/17] mpi3mr: Fix buffer overflow in BSG passthrough request copy Chandrakanth Patil
2026-08-25 16:09   ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 02/17] mpi3mr: Fix out-of-bounds read when copying BSG MPI requests Chandrakanth Patil
2026-08-25 16:06   ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 03/17] mpi3mr: Fix I/O block counter leak on admin request post failure Chandrakanth Patil
2026-08-25 16:06   ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 04/17] mpi3mr: Fix target device reference leak in BSG task management Chandrakanth Patil
2026-08-25 16:05   ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 05/17] mpi3mr: Fix buffer overflow when caching log data Chandrakanth Patil
2026-08-25 16:12   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 06/17] mpi3mr: Fix out-of-bounds reply frame access Chandrakanth Patil
2026-08-25 21:04 ` [PATCH v2 07/17] mpi3mr: Fix out-of-bounds sense buffer access Chandrakanth Patil
2026-08-25 16:08   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 08/17] mpi3mr: Fix out-of-bounds bitmap access during device removal Chandrakanth Patil
2026-08-25 16:11   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 09/17] mpi3mr: Fix target device reference leak in device removal handshake Chandrakanth Patil
2026-08-25 16:20   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 10/17] mpi3mr: Fix out-of-bounds read in SAS topology change events Chandrakanth Patil
2026-08-25 17:15   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 11/17] mpi3mr: Fix out-of-bounds read of event data Chandrakanth Patil
2026-08-25 16:06   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 12/17] mpi3mr: Fix out-of-bounds phy array access on link change Chandrakanth Patil
2026-08-25 16:18   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 13/17] mpi3mr: Fix buffer overflow in the BSG target device map Chandrakanth Patil
2026-08-25 16:07   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 14/17] mpi3mr: Fix out-of-bounds read in PCIe topology change events Chandrakanth Patil
2026-08-25 16:10   ` sashiko-bot
2026-08-25 21:04 ` Chandrakanth Patil [this message]
2026-08-25 21:04 ` [PATCH v2 16/17] mpi3mr: Fix use-after-free of the firmware event workqueue Chandrakanth Patil
2026-08-25 16:19   ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 17/17] mpi3mr: Fix NULL pointer dereference on PCI error recovery Chandrakanth Patil
2026-08-25 16:20   ` sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260825210411.301535-16-chandrakanth.patil@broadcom.com \
    --to=chandrakanth.patil@broadcom.com \
    --cc=ipylypiv@google.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=ranjan.kumar@broadcom.com \
    --cc=sathya.prakash@broadcom.com \
    --cc=sumit.saxena@broadcom.com \
    --cc=sweeti.vandure@broadcom.com \
    --cc=vishakhavc@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.