git: db87c98168b1 - main - ctl: avoid heap info leak in ctl_request_sense

The branch main has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=db87c98168b1605f067d283fa36a710369c3849d

commit db87c98168b1605f067d283fa36a710369c3849d
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-08-20 18:12:47 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-08-21 13:32:41 +0000

    ctl: avoid heap info leak in ctl_request_sense
    
    Previously 3 bytes of data from the heap could be leaked to ctl
    consumers.
    
    Reported by:    Synacktiv
    Reviewed by:    asomers, mav
    Sponsored by:   The Alpha-Omega Project
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D46091
---
 sys/cam/ctl/ctl.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c
index fac65e155890..845cffe77a5d 100644
--- a/sys/cam/ctl/ctl.c
+++ b/sys/cam/ctl/ctl.c
@@ -9304,14 +9304,8 @@ ctl_request_sense(struct ctl_scsiio *ctsio)
 	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
 	ctsio->kern_sg_entries = 0;
 	ctsio->kern_rel_offset = 0;
-
-	/*
-	 * struct scsi_sense_data, which is currently set to 256 bytes, is
-	 * larger than the largest allowed value for the length field in the
-	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
-	 */
-	ctsio->kern_data_len = cdb->length;
-	ctsio->kern_total_len = cdb->length;
+	ctsio->kern_data_len = ctsio->kern_total_len =
+	    MIN(cdb->length, sizeof(*sense_ptr));
 
 	/*
 	 * If we don't have a LUN, we don't have any pending sense.