[PATCH] mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

[PATCH] mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

[Dmitry Torokhov]

ipaq_micro_str() decodes a UTF-16LE string into an ASCII string.
It copies characters to a stack buffer retstr, but fails to
null-terminate it. When kstrdup() is called on retstr, it can read past
the buffer into uninitialized stack memory, potentially leaking stack
contents.

Fix this by initializing retstr to zero.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/mfd/ipaq-micro.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/ipaq-micro.c b/drivers/mfd/ipaq-micro.c
index 4b757d847282..5146a6eb0e5a 100644
--- a/drivers/mfd/ipaq-micro.c
+++ b/drivers/mfd/ipaq-micro.c
@@ -221,7 +221,7 @@ static void ipaq_micro_eeprom_read(struct ipaq_micro *micro,
 
 static char *ipaq_micro_str(u8 *wchar, u8 len)
 {
-	char retstr[256];
+	char retstr[256] = { 0 };
 	u8 i;
 
 	for (i = 0; i < len / 2; i++)
-- 
2.54.0.1099.g489fc7bff1-goog


-- 
Dmitry

Re: (subset) [PATCH] mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

[Lee Jones]

On Wed, 10 Jun 2026 16:03:52 -0700, Dmitry Torokhov wrote:
> ipaq_micro_str() decodes a UTF-16LE string into an ASCII string.
> It copies characters to a stack buffer retstr, but fails to
> null-terminate it. When kstrdup() is called on retstr, it can read past
> the buffer into uninitialized stack memory, potentially leaking stack
> contents.
> 
> Fix this by initializing retstr to zero.
> 
> [...]

Applied, thanks!

[1/1] mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str
      commit: 12d6d600e93bb15006109df42983d1236bb99a50

--
Lee Jones [李琼斯]