The QAT VF migration state buffer is allocated with kmalloc(), while
qat_vf_save_state() exposes all state_size bytes to userspace. The state
manager writes only the serialized sections, leaving the unused tail
unchanged. The first save can therefore disclose stale heap contents,
and subsequent saves can disclose data left by an earlier migration.

Zero the whole buffer before writing the setup data. Once the setup data
is present, preserve it and zero the remaining state area before each
state save.

Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Found by review. Compile-tested only; I do not have QAT hardware available.

Changes since RFC:
- Drop the RFC tag and mark the patch ready for application.
- Describe the concrete userspace exposure path and add Cc: stable.
- No code changes.

RFC: https://lore.kernel.org/r/20260817042613.19855-1-kmehltretter@gmail.com/

 drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
index bf2bae78a40d5..d8b961b2f2f7f 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
@@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev *mdev)
 		return ret;
 	}
 
+	memset(mdev->state + mdev->setup_size, 0,
+	       mdev->state_size - mdev->setup_size);
+
 	adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size,
 			    mdev->state_size - mdev->setup_size);
 	if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
@@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev *mdev)
 	if (mdev->setup_size)
 		return 0;
 
+	memset(mdev->state, 0, mdev->state_size);
+
 	adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size);
 	if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
 		return -EINVAL;
-- 
2.53.0

On Sat, Sep 19, 2026 at 07:49:34AM +0200, Karl Mehltretter wrote:
> The QAT VF migration state buffer is allocated with kmalloc(), while
> qat_vf_save_state() exposes all state_size bytes to userspace. The state
> manager writes only the serialized sections, leaving the unused tail
> unchanged. The first save can therefore disclose stale heap contents,
> and subsequent saves can disclose data left by an earlier migration.
> 
> Zero the whole buffer before writing the setup data. Once the setup data
> is present, preserve it and zero the remaining state area before each
> state save.
> 
> Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Found by review. Compile-tested only; I do not have QAT hardware available.
> 
> Changes since RFC:
> - Drop the RFC tag and mark the patch ready for application.
> - Describe the concrete userspace exposure path and add Cc: stable.
> - No code changes.
> 
> RFC: https://lore.kernel.org/r/20260817042613.19855-1-kmehltretter@gmail.com/
> 
>  drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++
>  1 file changed, 5 insertions(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt