Re: [PATCH 1/2] tty: vcc: zero-initialize control packet in vcc_send_ctl()

On 31. 07. 26, 10:32, Greg Kroah-Hartman wrote:
> On Fri, Jul 31, 2026 at 10:29:14AM +0200, Jiri Slaby wrote:
>> On 31. 07. 26, 10:15, Greg Kroah-Hartman wrote:
>>> From: Joshua Rogers <[email protected]>
>>>
>>> The stack-allocated struct vio_vcc pkt was partially initialized,
>>> leaving the tag.stype_env field uninitialized before being sent via
>>> ldc_write(), potentially leaking kernel stack data to the LDC peer.
>>>
>>> Assisted-by: AISLE:Snapshot
>>> Cc: stable <[email protected]>
>>> Signed-off-by: Joshua Rogers <[email protected]>
>>> Signed-off-by: Greg Kroah-Hartman <[email protected]>
>>> ---
>>>    drivers/tty/vcc.c | 2 +-
>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
>>> index 27a55465bf5e..3947bd2b75ac 100644
>>> --- a/drivers/tty/vcc.c
>>> +++ b/drivers/tty/vcc.c
>>> @@ -492,7 +492,7 @@ static ssize_t domain_show(struct device *dev,
>>>    static int vcc_send_ctl(struct vcc_port *port, int ctl)
>>>    {
>>> -	struct vio_vcc pkt;
>>> +	struct vio_vcc pkt = {};
>>
>> Note this needs not initialize holes.
> 
> Does it?  I keep forgetting this if it's really true or not.  I think
> we've been through this in the past but I can't find the archives.
> 
>> I believe there are none here, but memset() is usually
>> preferred/safer.
> 
> Last I remember, a long time ago, the compiler would just use memset()
> for this, and hit the holes.  Or is that a compiler-specific issue?
> 
> Yes, it's more obvious, and I'll be glad to change it, but figuring this
> out for real would be great :)

OK, so the standard (C17) does not guarantee zeroing.

What I found though:

* both clang and gcc zero the full struct for "{}". There was a bug in 
gcc < 8 where it did not.

* this is not true for designated initializer, cf. ce50039be49e ("net: 
sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak")).


Adding Kees who is the author of:
====
Memory initialization
---------------------

Memory copied to userspace must always be fully initialized. If not
explicitly memset(), this will require changes to the compiler to make
sure structure holes are cleared.
====

He might aware of more bugs.



FWIW, {} here should be safe for two reasons:
* not a designated initializer
* no holes (IMO)

thanks,
-- 
js
suse labs