linux-kernel - [PATCH AUTOSEL 6.15 10/20] genirq/irq_sim: Initialize work context pointers properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250624041120.83191-10-sashal@kernel.org>
Date: Tue, 24 Jun 2025 00:11:09 -0400
From: Sasha Levin <sashal@...nel.org>
To: patches@...ts.linux.dev,
	stable@...r.kernel.org
Cc: Gyeyoung Baek <gye976@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Sasha Levin <sashal@...nel.org>,
	linus.walleij@...aro.org,
	bartosz.golaszewski@...aro.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH AUTOSEL 6.15 10/20] genirq/irq_sim: Initialize work context pointers properly

From: Gyeyoung Baek <gye976@...il.com>

[ Upstream commit 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819 ]

Initialize `ops` member's pointers properly by using kzalloc() instead of
kmalloc() when allocating the simulation work context. Otherwise the
pointers contain random content leading to invalid dereferencing.

Signed-off-by: Gyeyoung Baek <gye976@...il.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Link: https://lore.kernel.org/all/20250612124827.63259-1-gye976@gmail.com
Signed-off-by: Sasha Levin <sashal@...nel.org>
---

**YES**

This commit should be backported to stable kernel trees, specifically to
the v6.11 stable series and any newer stable branches.

## Detailed Explanation:

### 1. **Critical Bug Fix**
The commit fixes a serious uninitialized memory bug. The code change
from `kmalloc()` to `kzalloc()` is critical because:

```c
// Before (buggy):
struct irq_sim_work_ctx *work_ctx __free(kfree) =
    kmalloc(sizeof(*work_ctx), GFP_KERNEL);

// After (fixed):
struct irq_sim_work_ctx *work_ctx __free(kfree) =
    kzalloc(sizeof(*work_ctx), GFP_KERNEL);
```

### 2. **The Bug Impact**
The `irq_sim_work_ctx` structure contains an `ops` member with function
pointers:
- `ops.irq_sim_irq_requested`
- `ops.irq_sim_irq_released`

When `irq_domain_create_sim_full()` is called with `ops=NULL` (which
happens when using the older `irq_domain_create_sim()` API), these
pointers are left uninitialized with random memory content.

### 3. **Potential Consequences**
The uninitialized pointers are checked in:
- `irq_sim_request_resources()`: `if
  (work_ctx->ops.irq_sim_irq_requested)`
- `irq_sim_release_resources()`: `if
  (work_ctx->ops.irq_sim_irq_released)`

If these random values are non-zero, the kernel will attempt to call
garbage function pointers, leading to:
- **Kernel crashes/panics**
- **Security vulnerabilities** (jumping to arbitrary memory)
- **Unpredictable behavior**

### 4. **Simple and Safe Fix**
The fix is minimal (changing one function call) with no side effects:
- `kzalloc()` guarantees all fields are zero-initialized
- This ensures function pointers are NULL when not explicitly set
- No performance impact (negligible difference for a one-time
  allocation)

### 5. **Affected Versions**
Based on my repository analysis:
- The bug was introduced in v6.11-rc1 (commit 011f583781fa)
- Only kernels v6.11 and newer are affected
- The fix should be backported to v6.11.y stable series

### 6. **Missing Fixes Tag**
The commit should have included:
```
Fixes: 011f583781fa ("genirq/irq_sim: add an extended irq_sim
initializer")
```

This is a textbook example of a commit that meets stable backport
criteria:
- Fixes a real bug that can cause crashes
- Small, contained change
- No new features or architectural changes
- Clear bugfix with minimal regression risk

 kernel/irq/irq_sim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/irq/irq_sim.c b/kernel/irq/irq_sim.c
index 1a3d483548e2f..ae4c9cbd1b4b9 100644
--- a/kernel/irq/irq_sim.c
+++ b/kernel/irq/irq_sim.c
@@ -202,7 +202,7 @@ struct irq_domain *irq_domain_create_sim_full(struct fwnode_handle *fwnode,
 					      void *data)
 {
 	struct irq_sim_work_ctx *work_ctx __free(kfree) =
-				kmalloc(sizeof(*work_ctx), GFP_KERNEL);
+				kzalloc(sizeof(*work_ctx), GFP_KERNEL);
 
 	if (!work_ctx)
 		return ERR_PTR(-ENOMEM);
-- 
2.39.5