From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37F723A9D9F for ; Fri, 7 Aug 2026 08:22:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786090975; cv=none; b=mtEiyqWiHSoxEX0OjzY26JGQbsvoxfuQjS74wjPbe6sJ1i82ZSVoHAzq7ScFv5y34LE75GFTTEMF0Xv4WUu3KYlyO+680oTS5EjHZ9gGhi7fEOIYuHyKKxsAkdUuKusWYnWjCMqfF+eALhcH6HVbvJmYQxn2o8Jg0PR6Zkl2yRE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786090975; c=relaxed/simple; bh=Ol6weHwfvEqXpA881m/xXsy5FEx3PNo6A4ehd7MX8ss=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ITQHqxtu+Lt7ZuK4fXTsWVMb7Ta5TaV4Oot3hm5tMv3qnlRnLmvQ7ImeQ/82mIOVModyFMYvOjdZI9PimMdvSi1tBFyIX0ntd6ToXyN9n8xT4XngxpPQBAv6w1qOAZEUyzc0QOja32gfAtE4Ypl90JSuTXuYmk45OO630bsRKIQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=philpotter.co.uk; spf=pass smtp.mailfrom=philpotter.co.uk; dkim=pass (2048-bit key) header.d=philpotter-co-uk.20251104.gappssmtp.com header.i=@philpotter-co-uk.20251104.gappssmtp.com header.b=b/665Gqy; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=philpotter.co.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=philpotter.co.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=philpotter-co-uk.20251104.gappssmtp.com header.i=@philpotter-co-uk.20251104.gappssmtp.com header.b="b/665Gqy" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-47fe2d179e2so1989333f8f.1 for ; Fri, 07 Aug 2026 01:22:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=philpotter-co-uk.20251104.gappssmtp.com; s=20251104; t=1786090969; x=1786695769; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=63Ixp7OHp2bl8rhhzLiZyFcS9wHaAIp4HHkrykUVwIQ=; b=b/665GqyjKvdkZFtarLjLHdOy1jxxnuzW93sud2iM8BR2EfCKSinLQD4KoWl7oZdQt mckFJGofCba2u/gOVh48Qejq6HbW89wzrRPo7MEp9L1emhUaviJGjoIIliRxGyGWmx7a L1GxnpA9IksCkAwx5xIXsljQNhLbyk9Y9f6Y6fibtunzpdYb3vUsR9EhLeWHa7MW1WrJ NXOoByxnHd3gcKw+t7w7rRMw16UCbtHhbCtMW2sTx1LSxTVzlts5Wa2l4XZKgWjrr3XR RktE/jugipxH6z2fyGRgGKF5mxmPwFdteWzruRZV0AagGR6dbbW54zhlRQ9mDRItAeWK XHyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786090969; x=1786695769; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=63Ixp7OHp2bl8rhhzLiZyFcS9wHaAIp4HHkrykUVwIQ=; b=qpFHw6iSGTmy5AG8WGlFd5Wrpbq4YwGh5xtVmEj06POi2YzmCl+GVlMxnIACWNvI2N Q2qA8NCs7PcGxtXdaoAIqu1ox8vdiHNrG0xBVjSHt45NdYnh8OMR1G8gMUSdGXN34Poj 7tFknul4W5TIi1jzobvjaYI28L6EKq6cPrMcmqplnGNcowTNnH/KrCSSCMZMSvpl0/44 pEerKbyNGyGLo+q4T8qMWNDWr8yuNqzpTxxSpaXOiu1DObvLez7IyWw2GgrIUarzsMIV wDWN661EyxP1N/j8JtyVHPuSDpvnvM5qsHyo3gQJVuSDwBzSGV5Df353qEMuwtQ1tRL4 +UBw== X-Gm-Message-State: AOJu0YyZVE7HyVHT8CFFdMPcJ9Damm7SqNJQ5TflBraSm+JofrDjb2+Z lUXFkG3huKCm8EP65HvNL4fdATSty5dwajuXaY65DYiVW9dBeGFUWOfd7BzAoJaxUTo= X-Gm-Gg: AR+sD13fEXLuT/1iy6v/TJSuny/KQvdW5Dav4ri1TjSMTaCsF239VaJpApawKAU2dbn 1NnzCedzmzYZKCljlCZwmE3o/tU+BDZhYljqa4c/Lr2stxlB0emaUE9dz5ITQasRrAHwLT8aX1r pQC+WYUFDIHi9o5InJyx1dyNB4zW5hgV508Qydai38NnNfUW8wd4NYTCRBGySBw1JDTXW0fh5rY Lu39lee2umh3HoZqReFMjZucliJq7J5r4eye/HzW6HAp/hmg1UsdS5aAtoZU6dcyRkTehuDr3T1 +dbEm0LbyFv1krtWkHBmKIJezMaihXMQdLL3V57YPiyEnLYG1QbeIlVw7tk+bvWpwcq5JXbIfDd HA4+EYofJmE1Bvq6Tmr/HMff2kJalXhJbV03Rjkp9VJe7MJ5NcY7zZxtpsf+d+nviKRaP9oNx+i Amd8mHHvvCF640Pn7STUnAFUONWqrmTv0Q2lXJPuqYrUeaMLSeJEm98SNhgMVCEpZSJaX+FV4ef oZimlVULtiG512OLgt6LjHm8tKXQMzzr7+EZL1c5TyaVWk= X-Received: by 2002:a5d:5f45:0:b0:47f:89cd:b48 with SMTP id ffacd0b85a97d-47fec5099e6mr32086006f8f.5.1786090969232; Fri, 07 Aug 2026 01:22:49 -0700 (PDT) Received: from equinox (2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6.1.f.d.0.b.8.0.1.0.0.2.ip6.arpa. [2001:8b0:df16::2]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4800220727bsm3471678f8f.33.2026.08.07.01.22.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 01:22:48 -0700 (PDT) Date: Fri, 7 Aug 2026 09:22:46 +0100 From: Phillip Potter To: Sreeraj S Kurup Cc: linux-kernel@vger.kernel.org, Phillip Potter Subject: Re: [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr Message-ID: References: <20260804132413.11837-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260804132413.11837-1-sreekuttan2156239@gmail.com> On Tue, Aug 04, 2026 at 01:24:13PM +0000, Sreeraj S Kurup wrote: > The 'header' structure is allocated on the stack and copied > to userspace using copy_to_user(). Uninitialized fields and > internal struct padding can leak random kernel stack data to > userspace processes, creating an information disclosure > vulnerability. > > Initialize 'header' to zero when declaring it so that all > fields and padding bytes are fully cleared before copying > to userspace. > > Signed-off-by: Sreeraj S Kurup > --- > drivers/cdrom/cdrom.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c > index 4f1fd389260f..f8c8dd4efa6c 100644 > --- a/drivers/cdrom/cdrom.c > +++ b/drivers/cdrom/cdrom.c > @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi, > static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi, > void __user *argp) > { > - struct cdrom_tochdr header; > + struct cdrom_tochdr header = {}; > int ret; > > /* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */ > -- > 2.54.0 > Hi Sreeraj, Thank you for this and your other patch. I will review and build/test these over the weekend and come back to you. Regards, Phil