Re: [PATCH v2] s390/pci: Fix leak of uninitialized kernel data in SCLP report

[sashiko-bot@kernel.org]

> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, but not that it is large enough to
> contain the report with the length claimed by report->length. If
> user-space provides a short buffer, meaning a larger report->length than
> the actually written payload, up to around 4K of kernel data from past
> the kmalloc(len + 1) sized buffer allocated in kernfs_fop_write_iter()
> will leak into the SCLP report.
> 
> However, as the entity processing the SCLP is privileged and able to
> access at least the page including the report, this does not leak data
> that entity could not access but it is still an out of bounds read and
> a malformed error report that should be rejected.
> 
> Fixes: 368704a65be8 ("s390/pci: add report_error attribute")
> Cc: stable@vger.kernel.org
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-fix_pci_sclp_length_check-v2-1-9ee9428e659f@linux.ibm.com?part=1