PROBLEM: buffer overflow and kernel panic in mmc_ioctl_cdrom_read_data

[Piotr Gabriel Kosinski]

When trying to read raw data from a CD drive using CDROMREADRAW ioctl
when a CD is not present, the kernel crashes with a stack corruption
error in mmc_ioctl_cdrom_read_data.

>From my (cursory) analysis it looks like the bug is caused by size
mismatch between:
- struct request_sense (64 bytes), used inside mmc_ioctl_cdrom_read_data
- unsigned char[96], expected inside scsi_execute

When the request_sense struct is passed to the cdrom_read_block, which
then ultimately calls scsi_execute, the struct gets overwritten and
overrun in drivers/scsi/scsi_lib.c:289:

if (sense && rq->sense_len)
        memcpy(sense, rq->sense, SCSI_SENSE_BUFFERSIZE);

I have recompiled the module with a hacky fix which replaces (in
mmc_ioctl_cdrom_read_data):

struct request_sense sense;

with

union {
        struct request_sense data;
        unsigned char buf[SCSI_SENSE_BUFFERSIZE];
} sense;

and that fixes the problem completely. The ioctl returns ENOMEDIUM as expected.

Regards,
Piotr Kosinski.