[PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr

[PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr

[Sreeraj S Kurup]

The 'header' structure is allocated on the stack and copied
to userspace using copy_to_user(). Uninitialized fields and
internal struct padding can leak random kernel stack data to
userspace processes, creating an information disclosure
vulnerability.

Initialize 'header' to zero when declaring it so that all
fields and padding bytes are fully cleared before copying
to userspace.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 drivers/cdrom/cdrom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 4f1fd389260f..f8c8dd4efa6c 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
 static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
 		void __user *argp)
 {
-	struct cdrom_tochdr header;
+	struct cdrom_tochdr header = {};
 	int ret;
 
 	/* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
-- 
2.54.0

Re: [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr

[Phillip Potter]

On Tue, Aug 04, 2026 at 01:24:13PM +0000, Sreeraj S Kurup wrote:
> The 'header' structure is allocated on the stack and copied
> to userspace using copy_to_user(). Uninitialized fields and
> internal struct padding can leak random kernel stack data to
> userspace processes, creating an information disclosure
> vulnerability.
> 
> Initialize 'header' to zero when declaring it so that all
> fields and padding bytes are fully cleared before copying
> to userspace.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
>  drivers/cdrom/cdrom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
> index 4f1fd389260f..f8c8dd4efa6c 100644
> --- a/drivers/cdrom/cdrom.c
> +++ b/drivers/cdrom/cdrom.c
> @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
>  static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
>  		void __user *argp)
>  {
> -	struct cdrom_tochdr header;
> +	struct cdrom_tochdr header = {};
>  	int ret;
>  
>  	/* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
> -- 
> 2.54.0
> 

Hi Sreeraj,

Thank you for this and your other patch. I will review and build/test
these over the weekend and come back to you.

Regards,
Phil