[PATCH v2] sunrpc: fix uninitialized xprt_create_args structure
Hongling Zeng <[email protected]>
| Newsgroups | gmane.linux.kernel.stable,gmane.linux.nfs,gmane.linux.network |
|---|---|
| Message-ID | <[email protected]> |
The xprt_create_args structure is allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some fields are manually populated, critical fields like srcaddr, bc_xps, and flags contain uninitialized stack garbage. This can lead to: 1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr 2. Information leak if srcaddr points to sensitive stack data 3. Unpredictable behavior if flags has random bits set The fix is to zero-initialize the structure to ensure all unused fields are NULL/0, preventing the transport setup code from acting on garbage data. Cc: [email protected] Suggested-by: Jeff Layton <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Hongling Zeng <[email protected]> --- Changes in V2: - Use designated initializer instead of memset, as suggested by Jeff Layton - Add Reviewed-by tag --- net/sunrpc/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c index a90480f80154..4669227a6de6 100644 --- a/net/sunrpc/sysfs.c +++ b/net/sunrpc/sysfs.c @@ -327,7 +327,7 @@ static ssize_t rpc_sysfs_xprt_switch_add_xprt_store(struct kobject *kobj, { struct rpc_xprt_switch *xprt_switch = rpc_sysfs_xprt_switch_kobj_get_xprt(kobj); - struct xprt_create xprt_create_args; + struct xprt_create xprt_create_args = {}; struct rpc_xprt *xprt, *new; if (!xprt_switch) -- 2.25.1