Re: [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr

[Phillip Potter <phil@philpotter.co.uk>]

On Tue, Aug 04, 2026 at 01:24:13PM +0000, Sreeraj S Kurup wrote:
> The 'header' structure is allocated on the stack and copied
> to userspace using copy_to_user(). Uninitialized fields and
> internal struct padding can leak random kernel stack data to
> userspace processes, creating an information disclosure
> vulnerability.
> 
> Initialize 'header' to zero when declaring it so that all
> fields and padding bytes are fully cleared before copying
> to userspace.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
>  drivers/cdrom/cdrom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
> index 4f1fd389260f..f8c8dd4efa6c 100644
> --- a/drivers/cdrom/cdrom.c
> +++ b/drivers/cdrom/cdrom.c
> @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
>  static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
>  		void __user *argp)
>  {
> -	struct cdrom_tochdr header;
> +	struct cdrom_tochdr header = {};
>  	int ret;
>  
>  	/* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
> -- 
> 2.54.0
> 

Hi Sreeraj,

Thank you for this and your other patch. I will review and build/test
these over the weekend and come back to you.

Regards,
Phil