git: 4c60b8289d0e - releng/14.0 - ctl: avoid heap info leak in ctl_request_sense

The branch releng/14.0 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=4c60b8289d0eaa4eb080ad96a7089635a691eee5

commit 4c60b8289d0eaa4eb080ad96a7089635a691eee5
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-08-20 18:12:47 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-09-04 20:54:02 +0000

    ctl: avoid heap info leak in ctl_request_sense
    
    Previously 3 bytes of data from the heap could be leaked to ctl
    consumers.
    
    Reported by:    Synacktiv
    Reviewed by:    asomers, mav
    Sponsored by:   The Alpha-Omega Project
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D46091
    
    (cherry picked from commit db87c98168b1605f067d283fa36a710369c3849d)
    (cherry picked from commit 131b7dcb2fbf8f15815387f60536d9cc16585b0d)
    
    Approved by:    so
---
 sys/cam/ctl/ctl.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c
index 5f5987e515c0..4706b424880f 100644
--- a/sys/cam/ctl/ctl.c
+++ b/sys/cam/ctl/ctl.c
@@ -9342,14 +9342,8 @@ ctl_request_sense(struct ctl_scsiio *ctsio)
 	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
 	ctsio->kern_sg_entries = 0;
 	ctsio->kern_rel_offset = 0;
-
-	/*
-	 * struct scsi_sense_data, which is currently set to 256 bytes, is
-	 * larger than the largest allowed value for the length field in the
-	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
-	 */
-	ctsio->kern_data_len = cdb->length;
-	ctsio->kern_total_len = cdb->length;
+	ctsio->kern_data_len = ctsio->kern_total_len =
+	    MIN(cdb->length, sizeof(*sense_ptr));
 
 	/*
 	 * If we don't have a LUN, we don't have any pending sense.