[PATCH] cdrom: fix stack leak in cdrom_ioctl_read_tochdr

[Sreeraj S Kurup]

The 'header' structure is allocated on the stack and copied
to userspace using copy_to_user(). Uninitialized fields and
internal struct padding can leak random kernel stack data to
userspace processes, creating an information disclosure
vulnerability.

Initialize 'header' to zero when declaring it so that all
fields and padding bytes are fully cleared before copying
to userspace.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
---
 drivers/cdrom/cdrom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 4f1fd389260f..f8c8dd4efa6c 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2629,7 +2629,7 @@ static int cdrom_ioctl_get_subchnl(struct cdrom_device_info *cdi,
 static int cdrom_ioctl_read_tochdr(struct cdrom_device_info *cdi,
 		void __user *argp)
 {
-	struct cdrom_tochdr header;
+	struct cdrom_tochdr header = {};
 	int ret;
 
 	/* cd_dbg(CD_DO_IOCTL, "entering CDROMREADTOCHDR\n"); */
-- 
2.54.0