diff options
| author | Ritesh Harjani (IBM) <ritesh.list@gmail.com> | 2026-05-01 07:11:41 +0300 |
|---|---|---|
| committer | Madhavan Srinivasan <maddy@linux.ibm.com> | 2026-05-06 05:00:24 +0300 |
| commit | cefeed44296261173a806bef988b26bc565da4be (patch) | |
| tree | 8bbc2fd0e8cbe33b9df5c55d1dd82ecfe5c6699a | |
| parent | 7a4f0846ee6cc8cf44ae0046ed42e3259d1dd45b (diff) | |
| download | linux-cefeed44296261173a806bef988b26bc565da4be.tar.xz | |
pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
The hdr variable is allocated on the stack and only hdr.version and
hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr
contains reserved padding bytes (reserved[3] and reserved2[40]), these
could leak the uninitialized bytes to userspace after copy_to_user().
This patch fixes that by initializing the whole struct to 0.
Cc: stable@vger.kernel.org
Fixes: cebdb522fd3ed ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/7bfe03b65a282c856ed8182d1871bb973c0b78f2.1777606826.git.ritesh.list@gmail.com
| -rw-r--r-- | arch/powerpc/platforms/pseries/papr-hvpipe.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/powerpc/platforms/pseries/papr-hvpipe.c b/arch/powerpc/platforms/pseries/papr-hvpipe.c index c41d45e1986d..3392874ebdf6 100644 --- a/arch/powerpc/platforms/pseries/papr-hvpipe.c +++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c @@ -327,7 +327,7 @@ static ssize_t papr_hvpipe_handle_read(struct file *file, { struct hvpipe_source_info *src_info = file->private_data; - struct papr_hvpipe_hdr hdr; + struct papr_hvpipe_hdr hdr = {}; long ret; /* |