[PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[Niklas Schnelle]

While report_error_write() checks that the provided buffer is at least
as large as the header struct, it does not currently check that the
buffer is large enough to contain the report with the length claimed by
report->length. If user-space provides a short buffer, i.e. a larger
report->length than the actually written payload, unininitialized kernel
data from the page allocated in kernfs_fop_write_iter() will leak into
the SCLP report.

As the entity processing the SCLP is privileged and able to access at
least the page including the report, this does not actually leak data
that it would not already be able to access. Still, the sysfs write is
malformed so reject it as invalid.

Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
---
 arch/s390/pci/pci_sysfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
index d98d97df792a..bbb76113a4d0 100644
--- a/arch/s390/pci/pci_sysfs.c
+++ b/arch/s390/pci/pci_sysfs.c
@@ -153,6 +153,9 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj,
 	if (off || (count < sizeof(*report)))
 		return -EINVAL;
 
+	if (count < (report->length + sizeof(*report)))
+		return -EINVAL;
+
 	ret = sclp_pci_report(report, zdev->fh, zdev->fid);
 
 	return ret ? ret : count;

---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260803-fix_pci_sclp_length_check-aa68495b1990

Best regards,
-- 
Niklas Schnelle

Re: [PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[sashiko-bot]

> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, it does not currently check that the
> buffer is large enough to contain the report with the length claimed by
> report->length. If user-space provides a short buffer, i.e. a larger
> report->length than the actually written payload, unininitialized kernel
> data from the page allocated in kernfs_fop_write_iter() will leak into
> the SCLP report.
> 
> As the entity processing the SCLP is privileged and able to access at
> least the page including the report, this does not actually leak data
> that it would not already be able to access. Still, the sysfs write is
> malformed so reject it as invalid.
> 
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805-fix_pci_sclp_length_check-v1-1-d125cb415bc3@linux.ibm.com?part=1

Re: [PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[Niklas Schnelle]

On Wed, 2026-08-05 at 11:27 +0200, Niklas Schnelle wrote:
> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, it does not currently check that the
> buffer is large enough to contain the report with the length claimed by
> report->length. If user-space provides a short buffer, i.e. a larger
> report->length than the actually written payload, unininitialized kernel
> data from the page allocated in kernfs_fop_write_iter() will leak into
> the SCLP report.
> 
> As the entity processing the SCLP is privileged and able to access at
> least the page including the report, this does not actually leak data
> that it would not already be able to access. Still, the sysfs write is
> malformed so reject it as invalid.
> 
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> ---
>  arch/s390/pci/pci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
> index d98d97df792a..bbb76113a4d0 100644
> --- a/arch/s390/pci/pci_sysfs.c
> +++ b/arch/s390/pci/pci_sysfs.c
> @@ -153,6 +153,9 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj,
>  	if (off || (count < sizeof(*report)))
>  		return -EINVAL;
>  
> +	if (count < (report->length + sizeof(*report)))
> +		return -EINVAL;
> +
>  	ret = sclp_pci_report(report, zdev->fh, zdev->fid);
>  
>  	return ret ? ret : count;
> 
> ---

While Sashiko is clean my own bot correctly noted that in
kernfs_fop_write_iter() it's really a kmalloc() being overrun not a
page allocated for this purpose. Also it noted that maybe s390/pci
makes more sense as a subsystem prefix. Oh, and I really should include
a check for missing Fixes tag and Cc stable in my local review skill.
Will send a v2 ;)

Thanks,
Niklas