Re: [PATCH 1/2] tty: vcc: zero-initialize control packet in vcc_send_ctl()

[Greg Kroah-Hartman]

On Fri, Jul 31, 2026 at 10:29:14AM +0200, Jiri Slaby wrote:
> On 31. 07. 26, 10:15, Greg Kroah-Hartman wrote:
> > From: Joshua Rogers <linux@xxxxxxxxx>
> > 
> > The stack-allocated struct vio_vcc pkt was partially initialized,
> > leaving the tag.stype_env field uninitialized before being sent via
> > ldc_write(), potentially leaking kernel stack data to the LDC peer.
> > 
> > Assisted-by: AISLE:Snapshot
> > Cc: stable <stable@xxxxxxxxxx>
> > Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >   drivers/tty/vcc.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
> > index 27a55465bf5e..3947bd2b75ac 100644
> > --- a/drivers/tty/vcc.c
> > +++ b/drivers/tty/vcc.c
> > @@ -492,7 +492,7 @@ static ssize_t domain_show(struct device *dev,
> >   static int vcc_send_ctl(struct vcc_port *port, int ctl)
> >   {
> > -	struct vio_vcc pkt;
> > +	struct vio_vcc pkt = {};
> 
> Note this needs not initialize holes.

Does it?  I keep forgetting this if it's really true or not.  I think
we've been through this in the past but I can't find the archives.

> I believe there are none here, but memset() is usually
> preferred/safer.

Last I remember, a long time ago, the compiler would just use memset()
for this, and hit the holes.  Or is that a compiler-specific issue?

Yes, it's more obvious, and I'll be glad to change it, but figuring this
out for real would be great :)

thanks,

greg k-h