From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:55539)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <agraf@suse.de>) id 1b5Wmx-0007LD-EE
	for qemu-devel@nongnu.org; Wed, 25 May 2016 07:15:48 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <agraf@suse.de>) id 1b5Wmv-00067n-EO
	for qemu-devel@nongnu.org; Wed, 25 May 2016 07:15:46 -0400
Received: from mx2.suse.de ([195.135.220.15]:32929)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <agraf@suse.de>) id 1b5Wmv-00067B-71
	for qemu-devel@nongnu.org; Wed, 25 May 2016 07:15:45 -0400
References: <1464172291-2856-1-git-send-email-ppandit@redhat.com>
	<1464172291-2856-3-git-send-email-ppandit@redhat.com>
From: Alexander Graf <agraf@suse.de>
Message-ID: <5745895F.4030007@suse.de>
Date: Wed, 25 May 2016 13:15:43 +0200
MIME-Version: 1.0
In-Reply-To: <1464172291-2856-3-git-send-email-ppandit@redhat.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 2/3] scsi: megasas: initialise local
 configuration data buffer
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: P J P <ppandit@redhat.com>, Qemu Developers <qemu-devel@nongnu.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>, Li Qiang <liqiang6-s@360.cn>, Hannes Reinecke <hare@suse.de>, Prasad J Pandit <pjp@fedoraproject.org>

On 05/25/2016 12:31 PM, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When reading MegaRAID SAS controller configuration via MegaRAID
> Firmware Interface(MFI) commands, routine megasas_dcmd_cfg_read
> uses an uninitialised local data buffer. Initialise this buffer
> to avoid stack information leakage.
>
> Reported-by: Li Qiang <liqiang6-s@360.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>   hw/scsi/megasas.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> index dcbd3e1..7c08932 100644
> --- a/hw/scsi/megasas.c
> +++ b/hw/scsi/megasas.c
> @@ -1305,6 +1305,7 @@ static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
>       QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
>           num_pd_disks++;
>       }
> +    memset(data, 0, sizeof(data));

Just replace the variable declaration with

   uint8_t data[4096] = "";

or

   uint8_t data[4096] = { 0 };

That should automatically get you a fully zeroed frame on the stack.


Alex

>       info = (struct mfi_config_data *)&data;
>       /*
>        * Array mapping: