Commit a9f07790 authored Dec 08, 2023 by Xingyuan Mo Committed by Oded Gabbay Dec 19, 2023

accel/habanalabs: fix information leak in sec_attest_info()

This function may copy the pad0 field of struct hl_info_sec_attest to user
mode which has not been initialized, resulting in leakage of kernel heap
data to user mode. To prevent this, use kzalloc() to allocate and zero out
the buffer, which can also eliminate other uninitialized holes, if any.

Fixes: 0c88760f ("habanalabs/gaudi2: add secured attestation info uapi")
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>

parent bc5f15ab

drivers/accel/habanalabs/common/habanalabs_ioctl.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -688,7 +688,7 @@ static int sec_attest_info(struct hl_fpriv hpriv, struct hl_info_args args)
		if (!sec_attest_info)
		return -ENOMEM;

		info = kmalloc(sizeof(*info), GFP_KERNEL);
		info = kzalloc(sizeof(*info), GFP_KERNEL);
		if (!info) {
		rc = -ENOMEM;
		goto free_sec_attest_info;