git: 51768dc31df6 - stable/13 - ctl: avoid heap info leak in ctl_request_sense

The branch stable/13 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=51768dc31df6379aa4a1447a15f054508d16b4b1

commit 51768dc31df6379aa4a1447a15f054508d16b4b1
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-08-20 18:12:47 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-08-26 13:28:17 +0000

    ctl: avoid heap info leak in ctl_request_sense
    
    Previously 3 bytes of data from the heap could be leaked to ctl
    consumers.
    
    Reported by:    Synacktiv
    Reviewed by:    asomers, mav
    Sponsored by:   The Alpha-Omega Project
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D46091
    
    (cherry picked from commit db87c98168b1605f067d283fa36a710369c3849d)
    (cherry picked from commit 131b7dcb2fbf8f15815387f60536d9cc16585b0d)
---
 sys/cam/ctl/ctl.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c
index a31bbd3c8342..7a04a668e823 100644
--- a/sys/cam/ctl/ctl.c
+++ b/sys/cam/ctl/ctl.c
@@ -9339,14 +9339,8 @@ ctl_request_sense(struct ctl_scsiio *ctsio)
 	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
 	ctsio->kern_sg_entries = 0;
 	ctsio->kern_rel_offset = 0;
-
-	/*
-	 * struct scsi_sense_data, which is currently set to 256 bytes, is
-	 * larger than the largest allowed value for the length field in the
-	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
-	 */
-	ctsio->kern_data_len = cdb->length;
-	ctsio->kern_total_len = cdb->length;
+	ctsio->kern_data_len = ctsio->kern_total_len =
+	    MIN(cdb->length, sizeof(*sense_ptr));
 
 	/*
 	 * If we don't have a LUN, we don't have any pending sense.