Re: [PATCH v2] s390/pci: Fix leak of uninitialized kernel data in SCLP report

On Thu, Aug 06, 2026 at 11:43:39AM +0200, Niklas Schnelle wrote:
> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, but not that it is large enough to
> contain the report with the length claimed by report->length. If
> user-space provides a short buffer, meaning a larger report->length than
> the actually written payload, up to around 4K of kernel data from past
> the kmalloc(len + 1) sized buffer allocated in kernfs_fop_write_iter()
> will leak into the SCLP report.
> 
> However, as the entity processing the SCLP is privileged and able to
> access at least the page including the report, this does not leak data
> that entity could not access but it is still an out of bounds read and
> a malformed error report that should be rejected.
> 
> Fixes: 368704a65be8 ("s390/pci: add report_error attribute")
> Cc: [email protected]
> Signed-off-by: Niklas Schnelle <[email protected]>
> ---
> Changes in v2:
> - Changed subsystem prefix to s390/pci
> - Added Fixes tag and Cc stable
> - Improved commit message
> - Link to v1: https://lore.kernel.org/r/20260805-fix_pci_sclp_length_check-v1-1-d125cb415bc3@linux.ibm.com
> ---
>  arch/s390/pci/pci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)

Applied, thank you!