Skip to content

Commit 0479b6e

Browse files
riteshharjanigregkh
authored andcommitted
pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
commit cefeed4 upstream. The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copy_to_user(). This patch fixes that by initializing the whole struct to 0. Cc: stable@vger.kernel.org Fixes: cebdb52 ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS") Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/7bfe03b65a282c856ed8182d1871bb973c0b78f2.1777606826.git.ritesh.list@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 0ff2b71 commit 0479b6e

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

arch/powerpc/platforms/pseries/papr-hvpipe.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ static ssize_t papr_hvpipe_handle_read(struct file *file,
327327
{
328328

329329
struct hvpipe_source_info *src_info = file->private_data;
330-
struct papr_hvpipe_hdr hdr;
330+
struct papr_hvpipe_hdr hdr = {};
331331
long ret;
332332

333333
/*

0 commit comments

Comments
 (0)