query_capability() copies four ACPI buffers into fixed-size fields using
the firmware-supplied lengths.  The existing overflow guard rejects
oversized buffers, but shorter buffers are accepted and leave trailing
bytes of the stack-allocated cap_hdr uninitialized.  PFRU_IOC_QUERY_CAP
then copies the entire structure to userspace.

Zero-initialize cap_hdr before querying the firmware.  This preserves the
existing handling of short firmware responses while preventing disclosure
of kernel stack data.  Oversized buffers remain rejected.

A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
bytes in all four fields.  With this change, the ioctl still succeeds and
each unwritten suffix is zero-filled, while 64-byte buffers continue to
return -EINVAL.

Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 drivers/acpi/pfr_update.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 9afd2c52fdbd..98ace679601b 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
 
 static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-	struct pfru_update_cap_info cap_hdr;
+	struct pfru_update_cap_info cap_hdr = {};
 	struct pfru_device *pfru_dev = to_pfru_dev(file);
 	void __user *p = (void __user *)arg;
 	u32 rev;
-- 
2.39.5 (Apple Git-154)

On Thu, Aug 27, 2026 at 7:39 AM Karl Mehltretter <kmehltretter@gmail.com> wrote:
>
> query_capability() copies four ACPI buffers into fixed-size fields using
> the firmware-supplied lengths.  The existing overflow guard rejects
> oversized buffers, but shorter buffers are accepted and leave trailing
> bytes of the stack-allocated cap_hdr uninitialized.  PFRU_IOC_QUERY_CAP
> then copies the entire structure to userspace.
>
> Zero-initialize cap_hdr before querying the firmware.  This preserves the
> existing handling of short firmware responses while preventing disclosure
> of kernel stack data.  Oversized buffers remain rejected.
>
> A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
> bytes in all four fields.  With this change, the ioctl still succeeds and
> each unwritten suffix is zero-filled, while 64-byte buffers continue to
> return -EINVAL.
>
> Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>  drivers/acpi/pfr_update.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> index 9afd2c52fdbd..98ace679601b 100644
> --- a/drivers/acpi/pfr_update.c
> +++ b/drivers/acpi/pfr_update.c
> @@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
>
>  static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  {
> -       struct pfru_update_cap_info cap_hdr;
> +       struct pfru_update_cap_info cap_hdr = {};
>         struct pfru_device *pfru_dev = to_pfru_dev(file);
>         void __user *p = (void __user *)arg;
>         u32 rev;
> --

Applied as 7.4 material, thanks!