Re: [PATCH] s390/sclp: Fix leak of uninitialized kernel data in SCLP report

[Niklas Schnelle]

On Wed, 2026-08-05 at 11:27 +0200, Niklas Schnelle wrote:
> While report_error_write() checks that the provided buffer is at least
> as large as the header struct, it does not currently check that the
> buffer is large enough to contain the report with the length claimed by
> report->length. If user-space provides a short buffer, i.e. a larger
> report->length than the actually written payload, unininitialized kernel
> data from the page allocated in kernfs_fop_write_iter() will leak into
> the SCLP report.
> 
> As the entity processing the SCLP is privileged and able to access at
> least the page including the report, this does not actually leak data
> that it would not already be able to access. Still, the sysfs write is
> malformed so reject it as invalid.
> 
> Signed-off-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
> ---
>  arch/s390/pci/pci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
> index d98d97df792a..bbb76113a4d0 100644
> --- a/arch/s390/pci/pci_sysfs.c
> +++ b/arch/s390/pci/pci_sysfs.c
> @@ -153,6 +153,9 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj,
>  	if (off || (count < sizeof(*report)))
>  		return -EINVAL;
>  
> +	if (count < (report->length + sizeof(*report)))
> +		return -EINVAL;
> +
>  	ret = sclp_pci_report(report, zdev->fh, zdev->fid);
>  
>  	return ret ? ret : count;
> 
> ---

While Sashiko is clean my own bot correctly noted that in
kernfs_fop_write_iter() it's really a kmalloc() being overrun not a
page allocated for this purpose. Also it noted that maybe s390/pci
makes more sense as a subsystem prefix. Oh, and I really should include
a check for missing Fixes tag and Cc stable in my local review skill.
Will send a v2 ;)

Thanks,
Niklas