git: 0f206cc91279 - main - cam: add missing zeroing of a stack-allocated CCB.

[Warner Losh]

On Sun, May 16, 2021, 11:55 AM Mark Johnston <markj at freebsd.org> wrote:

> On Sun, May 16, 2021 at 10:45:35AM +0000, Edward Tomasz Napierala wrote:
> > The branch main has been updated by trasz:
> >
> > URL:
> https://cgit.FreeBSD.org/src/commit/?id=0f206cc91279e630ad9e733eb6e330b7dbe6c70e
> >
> > commit 0f206cc91279e630ad9e733eb6e330b7dbe6c70e
> > Author:     Edward Tomasz Napierala <trasz at FreeBSD.org>
> > AuthorDate: 2021-05-16 09:28:04 +0000
> > Commit:     Edward Tomasz Napierala <trasz at FreeBSD.org>
> > CommitDate: 2021-05-16 10:38:26 +0000
> >
> >     cam: add missing zeroing of a stack-allocated CCB.
> >
> >     This could cause a panic at boot.
>
> There are other instances of this, for example syzbot is currently
> hitting an assertion, seemingly because the alloc_flags field of a
> stack-allocated CCB was not zeroed:
> https://syzkaller.appspot.com/bug?extid=2e9ce63919709feb3d1c
>
> I think the patch below will fix it, but I did not audit other callers.
> It feels a bit strange to require all callers of xpt_setup_ccb() to
> manually zero the structure first, can we provide a single routine to
> initialize stack-allocated CCBs?
>

If we did, we could set a flag we could assert on, and/or do static
analysis to find any others...

Warner

diff --git a/sys/dev/virtio/scsi/virtio_scsi.c
> b/sys/dev/virtio/scsi/virtio_scsi.c
> index 51d9e5f532f7..adf4fd17fc5b 100644
> --- a/sys/dev/virtio/scsi/virtio_scsi.c
> +++ b/sys/dev/virtio/scsi/virtio_scsi.c
> @@ -700,6 +700,7 @@ vtscsi_register_async(struct vtscsi_softc *sc)
>  {
>         struct ccb_setasync csa;
>
> +       memset(&csa, 0, sizeof(csa));
>         xpt_setup_ccb(&csa.ccb_h, sc->vtscsi_path, 5);
>         csa.ccb_h.func_code = XPT_SASYNC_CB;
>         csa.event_enable = AC_LOST_DEVICE | AC_FOUND_DEVICE;
> @@ -716,6 +717,7 @@ vtscsi_deregister_async(struct vtscsi_softc *sc)
>  {
>         struct ccb_setasync csa;
>
> +       memset(&csa, 0, sizeof(csa));
>         xpt_setup_ccb(&csa.ccb_h, sc->vtscsi_path, 5);
>         csa.ccb_h.func_code = XPT_SASYNC_CB;
>         csa.event_enable = 0;
>