Re: [Re: Linux 2.6.26-rc2] Write protect on on

Alan Stern
2008-06-23T15:04:52Z

On Fri, 20 Jun 2008, James Bottomley wrote:

> Yes, thanks. It's a bit nasty from a security point of view, since the
> leaking data apparently belonged to a different command. Wouldn't a
> better fix (and a more secure one) be to clear from the end of the valid
> data to the end of the buffer?

Here's the promised patch. Maciej and Peter, please try it out.

Alan Stern

Index: usb-2.6/drivers/scsi/scsi_lib.c
===================================================================
--- usb-2.6.orig/drivers/scsi/scsi_lib.c
+++ usb-2.6/drivers/scsi/scsi_lib.c
@@ -207,6 +207,15 @@ int scsi_execute(struct scsi_device *sde
*/
blk_execute_rq(req->q, NULL, req, 1);

+ /*
+ * Some devices (USB mass-storage in particular) may transfer
+ * garbage data together with a residue indicating that the data
+ * is invalid. Prevent the garbage from being misinterpreted
+ * and prevent security leaks by zeroing out the excess data.
+ */
+ if (unlikely(req->data_len > 0 && req->data_len <= bufflen))
+ memset(buffer + (bufflen - req->data_len), 0, req->data_len);
+
ret = req->errors;
out:
blk_put_request(req);