[PATCH net] rxrpc: rxgk: Initialize challenge control message

[Weiming Shi]

rxgk_challenge_to_recvmsg() copies the complete rxgk_challenge structure
into an RXRPC_CHALLENGED control message.  The pad member of the embedded
rxrpc_challenge is not assigned, so the copy can disclose one byte of
kernel stack memory to userspace.

Initialize the whole structure before filling its meaningful fields so
that the reserved byte is always zero.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Reported-by: <co+c09f7e87f6209a56@xxxxxxx>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
---
 net/rxrpc/rxgk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index 77a67ace1d248..799772b0d8472 100644
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -756,7 +756,7 @@ static int rxgk_challenge_to_recvmsg(struct rxrpc_connection *conn,
 				     struct sk_buff *challenge,
 				     struct msghdr *msg)
 {
-	struct rxgk_challenge chall;
+	struct rxgk_challenge chall = {};
 
 	chall.base.service_id		= conn->service_id;
 	chall.base.security_index	= conn->security_ix;
-- 
2.55.0