• David Jeffery's avatar
    [SCSI] st: fix possible memory use after free after MTSETBLK ioctl · 2c2ed8bf
    David Jeffery authored
    A memory use after free bug can manifest if the MTSETBLK or SET_DENS_AND_BLK
    ioctl features are used to set the tape's blocksize from 0 to non-zero.
    After the driver sets the new block size, in this one case it calls
    normalize_buffer() to free the device's internal data buffers.  However, the
    ioctl code assumes there is always a buffer and does not check or allocate
    a buffer if there isn't one.  So any following ioctl calls can corrupt
    a part of memory by writing data to memory that the st driver had freed.
    
    This patch removes the normalize_buffer() call and the specialness of
    changing from a 0 to non-zero blocksize to fix the possible use of
    memory after it has been freed by the st driver.
    signed-off-by: default avatarDavid Jeffery <djeffery@redhat.com>
    Acked-by: default avatarKai Makisara <kai.makisara@kolumbus.fi>
    Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
    2c2ed8bf
st.c 124 KB