Re: [PATCH 4/4] s390/dasd: Don't trust userspace-supplied result field in format check

[sashiko-bot@kernel.org]

> BIODASDCHECKFMT used to copy the entire format_check_t struct from
> userspace, including the result/unit/rec/num_records/blksize/
> key_length fields that are output fields only.
> dasd_eckd_format_evaluate_tracks() relies on cdata->result being zero
> to decide whether to apply an index correction (i--/pos--) after a
> successful check. A caller that pre-sets result to a non-zero value
> can suppress that correction, leaving pos advanced past the last valid
> entry; the (partially out-of-bounds) fmt_buffer[pos] fields are then
> copied back to userspace, leaking heap contents.
> 
> Only expect is an Input field; copy just that member in and zero
> the rest of cdata.
> 
> Fixes: 8fd575200db5 ("s390/dasd: Add new ioctl BIODASDCHECKFMT")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260722103704.1709668-1-sth@linux.ibm.com
> Cc: stable@vger.kernel.org #4.7
> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
> Signed-off-by: Stefan Haberland <sth@linux.ibm.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112102608.1057852-1-sth@linux.ibm.com?part=4