Re: [PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report
| Newsgroups | org.kernel.vger.linux-s390 |
|---|---|
| Message-ID | <[email protected]> |
> While report_error_write() checks that the provided buffer is at least > as large as the header struct, it does not currently check that the > buffer is large enough to contain the report with the length claimed by > report->length. If user-space provides a short buffer, i.e. a larger > report->length than the actually written payload, unininitialized kernel > data from the page allocated in kernfs_fop_write_iter() will leak into > the SCLP report. > > As the entity processing the SCLP is privileged and able to access at > least the page including the report, this does not actually leak data > that it would not already be able to access. Still, the sysfs write is > malformed so reject it as invalid. > > Signed-off-by: Niklas Schnelle <[email protected]> Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/20260805-fix_pci_sclp_length_check-v1-1-d125cb415bc3@linux.ibm.com?part=1