linux-kernel - Re: [PATCH][next] staging: gpib: fix unset padding field copy back to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cc005697-1911-485f-9c50-30442558851c@suswa.mountain>
Date: Tue, 24 Jun 2025 01:25:14 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Colin Ian King <colin.i.king@...il.com>
Cc: Dave Penkler <dpenkler@...il.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Michael Rubin <matchstick@...erthere.org>,
	linux-staging@...ts.linux.dev, kernel-janitors@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] staging: gpib: fix unset padding field copy back
 to userspace

On Mon, Jun 23, 2025 at 11:09:58PM +0100, Colin Ian King wrote:
> The introduction of a padding field in the gpib_board_info_ioctl is
> showing up as initialized data on the stack frame being copyied back
> to userspace in function board_info_ioctl. The simplest fix is to
> initialize the entire struct to zero to ensure all unassigned padding
> fields are zero'd before being copied back to userspace.
> 
> Fixes: b8394732ff0c ("staging: gpib: Add bit and byte padding to ioctl structs")
> Signed-off-by: Colin Ian King <colin.i.king@...il.com>
> ---

The fix is good, but the bug has been there since the driver was
introduced, it's only just now that the static checkers have started
catching it.  Oddly/sadly Smatch doesn't catch this one.  I'll have to
investigate.

Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver")

regards,
dan carpenter