Re: [PATCH] ACPI: pfr_update: zero-initialize capability query result

[Rafael J. Wysocki (Intel)]

On Thu, Aug 27, 2026 at 7:39 AM Karl Mehltretter <kmehltretter@xxxxxxxxx> wrote:
>
> query_capability() copies four ACPI buffers into fixed-size fields using
> the firmware-supplied lengths.  The existing overflow guard rejects
> oversized buffers, but shorter buffers are accepted and leave trailing
> bytes of the stack-allocated cap_hdr uninitialized.  PFRU_IOC_QUERY_CAP
> then copies the entire structure to userspace.
>
> Zero-initialize cap_hdr before querying the firmware.  This preserves the
> existing handling of short firmware responses while preventing disclosure
> of kernel stack data.  Oversized buffers remain rejected.
>
> A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
> bytes in all four fields.  With this change, the ioctl still succeeds and
> each unwritten suffix is zero-filled, while 64-byte buffers continue to
> return -EINVAL.
>
> Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> ---
>  drivers/acpi/pfr_update.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
> index 9afd2c52fdbd..98ace679601b 100644
> --- a/drivers/acpi/pfr_update.c
> +++ b/drivers/acpi/pfr_update.c
> @@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
>
>  static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  {
> -       struct pfru_update_cap_info cap_hdr;
> +       struct pfru_update_cap_info cap_hdr = {};
>         struct pfru_device *pfru_dev = to_pfru_dev(file);
>         void __user *p = (void __user *)arg;
>         u32 rev;
> --

Applied as 7.4 material, thanks!