Re: [PATCH v2] s390/pci: Fix leak of uninitialized kernel data in SCLP report

On Thu, Aug 06, 2026 at 11:43:39AM +0200, Niklas Schnelle wrote:
> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, but not that it is large enough to
> contain the report with the length claimed by report->length. If
> user-space provides a short buffer, meaning a larger report->length than
> the actually written payload, up to around 4K of kernel data from past
> the kmalloc(len + 1) sized buffer allocated in kernfs_fop_write_iter()
> will leak into the SCLP report.
> 
> However, as the entity processing the SCLP is privileged and able to
> access at least the page including the report, this does not leak data
> that entity could not access but it is still an out of bounds read and
> a malformed error report that should be rejected.
> 
> Fixes: 368704a65be8 ("s390/pci: add report_error attribute")
> Cc: [email protected]
> Signed-off-by: Niklas Schnelle <[email protected]>
> ---
> Changes in v2:
> - Changed subsystem prefix to s390/pci
> - Added Fixes tag and Cc stable
> - Improved commit message
> - Link to v1: https://lore.kernel.org/r/20260805-fix_pci_sclp_length_check-v1-1-d125cb415bc3@linux.ibm.com
> ---
>  arch/s390/pci/pci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
> index d98d97df792a..bbb76113a4d0 100644
> --- a/arch/s390/pci/pci_sysfs.c
> +++ b/arch/s390/pci/pci_sysfs.c
> @@ -153,6 +153,9 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj,
>  	if (off || (count < sizeof(*report)))
>  		return -EINVAL;
>  
> +	if (count < (report->length + sizeof(*report)))
> +		return -EINVAL;
> +
>  	ret = sclp_pci_report(report, zdev->fh, zdev->fid);
>  
>  	return ret ? ret : count;

Looks good to me.


Reviewed-by: Benjamin Block <[email protected]>

-- 
Best Regards, Benjamin Block        /        Linux on IBM Z Kernel Development
IBM Deutschland Research & Development GmbH    /   https://www.ibm.com/privacy
Vors. Aufs.-R.: Wolfgang Wendt         /        Geschäftsführung: David Faller
Sitz der Ges.: Ehningen     /     Registergericht: AmtsG Stuttgart, HRB 243294