Commit cefeed44 authored by Ritesh Harjani (IBM)'s avatar Ritesh Harjani (IBM) Committed by Madhavan Srinivasan
Browse files

pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace 



The hdr variable is allocated on the stack and only hdr.version and
hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr
contains reserved padding bytes (reserved[3] and reserved2[40]), these
could leak the uninitialized bytes to userspace after copy_to_user().

This patch fixes that by initializing the whole struct to 0.

Cc: stable@vger.kernel.org
Fixes: cebdb522 ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS")
Signed-off-by: default avatarRitesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: default avatarMadhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/7bfe03b65a282c856ed8182d1871bb973c0b78f2.1777606826.git.ritesh.list@gmail.com
parent 7a4f0846

arch/powerpc/platforms/pseries/papr-hvpipe.c

+1 −1
Original line number Diff line number Diff line
@@ -327,7 +327,7 @@ static ssize_t papr_hvpipe_handle_read(struct file *file, 
{



	struct hvpipe_source_info *src_info = file->private_data;

	struct papr_hvpipe_hdr hdr;

	struct papr_hvpipe_hdr hdr = {};

	long ret;



	/*