From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E503480942 for ; Tue, 4 Aug 2026 16:49:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785862158; cv=none; b=anbBNGmo2BFMO+cn4DyIX6B3CFYnyXjOAsY9O1S1N/DFRy+1RGnn/okd+VNtX9ARuI/hsfFGFWHlCp+Tt6BwPH+q/3dWPMfmjv2WxnYfpcAjBIqawMFawqxKFs/VFLlC82l3ACqSv2qU/WuQN9/1jEuG6/ZfSg19gdsZQm6AGdw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785862158; c=relaxed/simple; bh=CwDmS4WnNxX2IrPmXTHYsA6ZkZCFZBJA3fBuXDgmsSo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eF2AQWK61xHjM6ydpCh36Ge4btp/TzJ9ZrvZepzrkkCWE16GM3DWIFDEOJwKYg7QT2YIca2azN8sBjOaIWCdgSl90ERV9ctvJDDg7bixXb/KX607nFAh+T4fV7/QB28tXJMewQI41U2QnEGDLOernurxMOEzJSqJ56K3Y1uILhA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=R3zw7yP3; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="R3zw7yP3" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so49516a91.0 for ; Tue, 04 Aug 2026 09:49:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785862152; x=1786466952; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=kXLtQXN/WE/r4uN3jXndHYoUJYjGyzWiYvsUsQPcQU0=; b=R3zw7yP3a8X3xbEEHYFOp+oeJJiZj2Xacz8BE7OkfC6XUfX8kInF7KiFn5Wy1lg5jG h8UWfRTIhWQx9zplDfUx+3atnzkXjGJnm+ij0uGriKt7OPJFATvWfVLrBcimJ4L+K2CA XcTzVjkcgBbzx7hTsl8uwmxCueKrJNSTuSRBw9atZ2RY5UoqMcQmiip9jE4WSc6jiipO RYZqU9jNOS4gR+NSc0qjNTeLZjDq0wocgaOqLPK2OOp8IkpMnKB/0RLGq7W+pBh84LUY unqYBnRv97IlWVQlSNvqXZePwirgq9RSDdvIDfKWNLqLOZzgq49qa6cITnoX2uzq2psV 5ZcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785862152; x=1786466952; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kXLtQXN/WE/r4uN3jXndHYoUJYjGyzWiYvsUsQPcQU0=; b=m15HwVC/zipYYwZXE7HRiRZLq73nG+WAgZR+eLAOFXl83uTIBrrQxuraS/bRXaBSEe R0yN+0rSn0VCtSkkPeqs6VnFRCDHYLRXmdXfgtqAyd2PeEEO3R5xHVK7XBWyZQa8m3Gn DFqzyXfSye5mWjCOBeURhyP0T7gIrh5mrqCWtUqxmO/Nbyax8FaaooMgr65Brvlr82U2 UkCcVD5d0xGFlkt8cgNMy2AVaBQXIpfXcRAupoDMd2tfuZHnhhfXIaVmPhW+f/Wv/JgO kgOM6DX2mXft9M02MsKsnvaWXeztX+3wQtnFDI3Ef+H904ke7uI52qJGTIOT66RXREIl 795g== X-Gm-Message-State: AOJu0YyhppJTa4ZjJ+cKfsa0KTT9N4iqSASXT01GehRiFpt746cnkjRk I2Nd+3WAo5JT0KJFPSwhpXfqfB29zno/mChfxKQKWNpkhfynOd7KeoBY X-Gm-Gg: AR+sD12E+Bq1NJrJL4Yy26u40E7MyTxhbBHjfO4jhwfg/CgQ9n/pDWJ5C1/jy9QvI8o NXZy2X6AvkBtjOFL87MfvC/7vgrzlbZyoaEZ5y5/aoX0aNiqEWTdw5ztZUyzMo/5EzN+NjjAr8j kRQ+55LcacEcQDF7UyxE+4BFHlM5DHdnlLy1E/IcdV9dl2wD67KG/m8hqtk/sKTTNAsxZNlODqh HgaehTUGaPijSiYnLY8OUGIGB+3vRa7ZAAkKbceBzf+lYT3YHOPLrE4cFFGBbfmVNfxA/NmPjYE rSNYMthWp2CeXthF2X60Uu3OHRPX8b298bFs8OCRjAG53SaTvSlSuaR4QmwBFo1AIBWctMk7+P8 M3dfQ0yznlK8w3TL1SA3Acw29mVmPxUtb5owIPV+w2WdtajhxBgP0Orf2VPeaqAPmD5LaQq9Jns rUnCtdeDo7rEIggwLXzZcFyPGGZzkrXwMRqMCNk2Rt0qWZFyHddgqPplo4P5+6+eJZKl5JdtNrB dHRQhFRMrvC X-Received: by 2002:a17:90b:1d05:b0:38f:f2cd:793f with SMTP id 98e67ed59e1d1-3903c690892mr318100a91.29.1785862152329; Tue, 04 Aug 2026 09:49:12 -0700 (PDT) Received: from localhost.localdomain ([103.179.230.122]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3158673bb38sm6861816eec.14.2026.08.04.09.49.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 09:49:11 -0700 (PDT) From: Sreeraj S Kurup To: Phillip Potter Cc: linux-kernel@vger.kernel.org, Sreeraj S Kurup Subject: [PATCH v2] cdrom: fix stack memory leaks in ioctl handlers Date: Tue, 4 Aug 2026 16:47:28 +0000 Message-ID: <20260804164728.3636-1-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Multiple ioctl handlers in drivers/cdrom/cdrom.c allocate structures on the kernel stack that are subsequently copied back to user space via copy_to_user(). Uninitialized structure padding bytes or unpopulated fields in these stack-allocated structures leak sensitive kernel stack memory to user space. Explicitly zero-initialize local structures across the affected output ioctl handlers using standard {0} initialization: - cdrom_ioctl_multisession: struct cdrom_multisession info - cdrom_ioctl_timed_media_change: struct cdrom_timed_media_change_info - cdrom_ioctl_get_mcn: struct cdrom_mcn mcn - cdrom_ioctl_get_subchnl: struct cdrom_subchnl q - cdrom_ioctl_read_tochdr: struct cdrom_tochdr header - cdrom_ioctl_read_tocentry: struct cdrom_tocentry entry - mmc_ioctl_cdrom_subchannel: struct cdrom_subchnl q This prevents kernel stack memory disclosure vulnerabilities when copying data structures back to user space. --- v2: - Expanded coverage to all remaining ioctl handlers in cdrom.c that copy stack structures back to user space. Signed-off-by: Sreeraj S Kurup --- drivers/cdrom/cdrom.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 4f1fd389260f..85be658bbfa3 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -2254,7 +2254,7 @@ EXPORT_SYMBOL_GPL(cdrom_multisession); static int cdrom_ioctl_multisession(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_multisession info; + struct cdrom_multisession info = {0}; int ret; cd_dbg(CD_DO_IOCTL, "entering CDROMMULTISESSION\n"); @@ -2361,7 +2361,7 @@ static int cdrom_ioctl_timed_media_change(struct cdrom_device_info *cdi, { int ret; struct cdrom_timed_media_change_info __user *info; - struct cdrom_timed_media_change_info tmp_info; + struct cdrom_timed_media_change_info tmp_info = {0}; if (!CDROM_CAN(CDC_MEDIA_CHANGED)) return -ENOSYS; @@ -2510,7 +2510,7 @@ static int cdrom_ioctl_get_capability(struct cdrom_device_info *cdi) static int cdrom_ioctl_get_mcn(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_mcn mcn; + struct cdrom_mcn mcn = {0}; int ret; cd_dbg(CD_DO_IOCTL, "entering CDROM_GET_MCN\n"); @@ -2598,7 +2598,7 @@ static int cdrom_ioctl_changer_nslots(struct cdrom_device_info *cdi) static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_subchnl q; + struct cdrom_subchnl q = {0}; u8 requested, back; int ret; @@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi, static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_tochdr header; + struct cdrom_tochdr header = {0}; int ret; /* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */ @@ -2669,7 +2669,7 @@ EXPORT_SYMBOL_GPL(cdrom_read_tocentry); static int cdrom_ioctl_read_tocentry(struct cdrom_device_info *cdi, void __user *argp) { - struct cdrom_tocentry entry; + struct cdrom_tocentry entry = {0}; int ret; if (copy_from_user(&entry, argp, sizeof(entry))) @@ -3055,7 +3055,7 @@ static noinline int mmc_ioctl_cdrom_subchannel(struct cdrom_device_info *cdi, void __user *arg) { int ret; - struct cdrom_subchnl q; + struct cdrom_subchnl q = {0}; u_char requested, back; if (copy_from_user(&q, (struct cdrom_subchnl __user *)arg, sizeof(q))) return -EFAULT; -- 2.54.0