From nobody Fri Oct 2 06:17:45 2026 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4CB33D413F for ; Tue, 4 Aug 2026 13:25:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785849914; cv=none; b=YOr6GceX3MM7NJ3TUZSBtQXOnAl+l9tShdzigyGVIiW7n1BMSsR1LfQ+H84AEn0CN5qRnEuNcqbkZqY6hVLbYcvfoO3dzYrKvwRq9HuZYT7mpvOUdYKdJvBqHLgYKR8k7VmYOjYOlRHdG29GgcLX1DxTwec0Mb7fG0Zl9aawo2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785849914; c=relaxed/simple; bh=wof/WwWfy3zHME00KCn7BaXx1CoHuxATo09eh0Z7kzo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FCjnjLrkjll0YoBR7JrKw8EKhWbUG95B64llB27YaVpfohXgGFvc90Z32cjhg7rzubhUs9CG5kqgNdWgX5omSnT8UILAlx+Tka7+Aa/i6OGsLTmwZ4xZX/NEUABvVK0ba3/0OprtuA21uomkpIyV56ATGrsCE15Mn5pBpxSW94Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s9n48E2V; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s9n48E2V" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-382ef647e20so4777563a91.1 for ; Tue, 04 Aug 2026 06:25:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785849912; x=1786454712; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=0TzkI9JCCxoPp+fHbK8y2t/QTtBNNrLSheAxSR4qYkE=; b=s9n48E2VY/L32ED/Zlx1NFhOtwptsv+Whp1T0N9uWjNp2JezmkX9UTKQNN2ceGLO25 K9TOzrLIwYEIIYic+KTmDj13+r53VFRWmeTcamFLOC/FJBIKDXrBHEXOve95lYtWDCEn Lv56E7XtlvpqHBY9JFZIrHFNG4MUP+w8k39wD5UJ6BPBb1Ivpit0qG3TRwKi2iuQD11+ fStI/9wE8IIKBgOKhu7bBXqzCXROnmer4UzbfOMgDD/9PCOU1CB/AzAtKsmHWTY2kQFS zx9GANRjfIDzCMMjFr1JkEt6hJUKomTpvkO22X4xQoqZZRryQosdyLjrzsR1Cfk32nTu Tg7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785849912; x=1786454712; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0TzkI9JCCxoPp+fHbK8y2t/QTtBNNrLSheAxSR4qYkE=; b=oEGpItC3y7bU8DSZPf6dvB450V/99KybSJ7tD5li5seRXvF924jFTMtXjroAGDJhYt 4cI0/4PbW5HVpd7rrdvA8FSpQIB+xvz/z2WiuHTbpJ+smpd5/xajhq1Kp4Y/3y9dVxGa ZhruJc97/ZD2J0gljXTRw8kKcp/Ech9972YAhhW45SRbn0rxsJ97Iu1ga3aqLRar/gpH 9Y4keIWUdgGFARPuIGx0elne6P5IvtQUUMw0Oxna8akhtGO59C/y3jsGUkKCCp4Xkb4+ a5dCrAIRv5E+A5Y5U9Shkeq5u/pjB+mmDbh9/ImAGXh3kTTjKKxLqEeWxdM0lmHNFPDh dO5A== X-Gm-Message-State: AOJu0Yz7v4gvGD83t9XBDuK+Vhr+B+2ksJqZNaJDmz+/3qsKTXLbTjyn cUHSAP35zCElDghPaZbAP/BfJIXHg8FuPGtv+S47tuNxF0guX4P9gGOFQ2CVO3ur X-Gm-Gg: AR+sD11Pbyl0cSZj8flJCm6NjdrKPXSZ5uZH8g2+I1SmgL5ZMit1G0rNtH6lzZnvSGd 46f0akJvmE3MALBmRrClhE3tMkPgW1iYTBX69hjQT8W7S5PmFy2XjZp8xYJ9PKLIkfmxgJ06dwJ GdZVJE3tSLovvUaWbpJe1wkWdDYu1W97dpYiySeyuVB28Yw09AuQHuBCHpTLGlgFPURinZfvXWM Lfa2o9d/Y/Ks49CPNt7yokj9uXcZBi2MoiSQd4sdDTQt8/FpxUp7Gj8Z3RYi0oMzcMO+7TAAW5d 5fEJtdu/bl4fZjMASQfVtlF7AYTVdys8hqZUaJNhhZ+h60Q/y7+/xfjq1YgdK2CBz2azwAbNgub nKCFO8fgsrCqtHqk1DArjrJA4ETLlYqIcMBXr/5LOgpSIGSLZFTehyNpFmXW7XOWypk9j8oGSbj 8Q8adpoX6AoqQvFgB0nal2ei86t/nEz3qzskww9TdKPhCzqW5wzpOcpWshH4HQaxW6cntq5ZX7H HPLC6cAfUCh X-Received: by 2002:a17:90b:53c7:b0:38d:a150:ee04 with SMTP id 98e67ed59e1d1-38fbc4ef153mr12211327a91.30.1785849912075; Tue, 04 Aug 2026 06:25:12 -0700 (PDT) Received: from localhost.localdomain ([103.179.230.122]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315867bc261sm4754458eec.28.2026.08.04.06.25.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 06:25:11 -0700 (PDT) From: Sreeraj S Kurup To: Phillip Potter Cc: linux-kernel@vger.kernel.org, Sreeraj S Kurup Subject: [PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr Date: Tue, 4 Aug 2026 13:24:13 +0000 Message-ID: <20260804132413.11837-1-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The 'header' structure is allocated on the stack and copied to userspace using copy_to_user(). Uninitialized fields and internal struct padding can leak random kernel stack data to userspace processes, creating an information disclosure vulnerability. Initialize 'header' to zero when declaring it so that all fields and padding bytes are fully cleared before copying to userspace. Signed-off-by: Sreeraj S Kurup --- drivers/cdrom/cdrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 4f1fd389260f..f8c8dd4efa6c 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_devic= e_info *cdi, static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_tochdr header; + struct cdrom_tochdr header =3D {}; int ret; =20 /* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */ --=20 2.54.0