* [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr
@ 2026-08-04 13:24 Sreeraj S Kurup
2026-08-07 8:22 ` Phillip Potter
0 siblings, 1 reply; 2+ messages in thread
From: Sreeraj S Kurup @ 2026-08-04 13:24 UTC (permalink / raw)
To: Phillip Potter; +Cc: linux-kernel, Sreeraj S Kurup
The 'header' structure is allocated on the stack and copied
to userspace using copy_to_user(). Uninitialized fields and
internal struct padding can leak random kernel stack data to
userspace processes, creating an information disclosure
vulnerability.
Initialize 'header' to zero when declaring it so that all
fields and padding bytes are fully cleared before copying
to userspace.
Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
drivers/cdrom/cdrom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 4f1fd389260f..f8c8dd4efa6c 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
void __user *argp)
{
- struct cdrom_tochdr header;
+ struct cdrom_tochdr header = {};
int ret;
/* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
--
2.54.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr
2026-08-04 13:24 [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr Sreeraj S Kurup
@ 2026-08-07 8:22 ` Phillip Potter
0 siblings, 0 replies; 2+ messages in thread
From: Phillip Potter @ 2026-08-07 8:22 UTC (permalink / raw)
To: Sreeraj S Kurup; +Cc: linux-kernel, Phillip Potter
On Tue, Aug 04, 2026 at 01:24:13PM +0000, Sreeraj S Kurup wrote:
> The 'header' structure is allocated on the stack and copied
> to userspace using copy_to_user(). Uninitialized fields and
> internal struct padding can leak random kernel stack data to
> userspace processes, creating an information disclosure
> vulnerability.
>
> Initialize 'header' to zero when declaring it so that all
> fields and padding bytes are fully cleared before copying
> to userspace.
>
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
> drivers/cdrom/cdrom.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
> index 4f1fd389260f..f8c8dd4efa6c 100644
> --- a/drivers/cdrom/cdrom.c
> +++ b/drivers/cdrom/cdrom.c
> @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
> static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
> void __user *argp)
> {
> - struct cdrom_tochdr header;
> + struct cdrom_tochdr header = {};
> int ret;
>
> /* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
> --
> 2.54.0
>
Hi Sreeraj,
Thank you for this and your other patch. I will review and build/test
these over the weekend and come back to you.
Regards,
Phil
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-07 8:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-04 13:24 [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr Sreeraj S Kurup
2026-08-07 8:22 ` Phillip Potter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.