[PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[Niklas Schnelle]

While report_error_write() checks that the provided buffer is at least
as large as the header struct, it does not currently check that the
buffer is large enough to contain the report with the length claimed by
report->length. If user-space provides a short buffer, i.e. a larger
report->length than the actually written payload, unininitialized kernel
data from the page allocated in kernfs_fop_write_iter() will leak into
the SCLP report.

As the entity processing the SCLP is privileged and able to access at
least the page including the report, this does not actually leak data
that it would not already be able to access. Still, the sysfs write is
malformed so reject it as invalid.

Signed-off-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
---
 arch/s390/pci/pci_sysfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
index d98d97df792a..bbb76113a4d0 100644
--- a/arch/s390/pci/pci_sysfs.c
+++ b/arch/s390/pci/pci_sysfs.c
@@ -153,6 +153,9 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj,
 	if (off || (count < sizeof(*report)))
 		return -EINVAL;
 
+	if (count < (report->length + sizeof(*report)))
+		return -EINVAL;
+
 	ret = sclp_pci_report(report, zdev->fh, zdev->fid);
 
 	return ret ? ret : count;

---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260803-fix_pci_sclp_length_check-aa68495b1990

Best regards,
-- 
Niklas Schnelle