diff options
| author | Hongling Zeng <zenghongling@kylinos.cn> | 2026-06-03 09:36:52 +0800 |
|---|---|---|
| committer | Anna Schumaker <anna.schumaker@hammerspace.com> | 2026-06-08 12:06:41 -0400 |
| commit | 17d90b68c3a3d7d7e95b49e1fe9381a723f637a8 (patch) | |
| tree | 722b21bed4e7d98053b99b2ad28e9e310fd3e314 /net/sunrpc | |
| parent | 3ff72e1cdf5c337b6acfcf3fcef748c5b9a5316b (diff) | |
| download | linux-next-17d90b68c3a3d7d7e95b49e1fe9381a723f637a8.tar.gz linux-next-17d90b68c3a3d7d7e95b49e1fe9381a723f637a8.zip | |
sunrpc: fix uninitialized xprt_create_args structure
The xprt_create_args structure is allocated on the stack without
initialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some
fields are manually populated, critical fields like srcaddr, bc_xps,
and flags contain uninitialized stack garbage.
This can lead to:
1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr
2. Information leak if srcaddr points to sensitive stack data
3. Unpredictable behavior if flags has random bits set
The fix is to zero-initialize the structure to ensure all unused
fields are NULL/0, preventing the transport setup code from acting
on garbage data.
Cc: stable@vger.kernel.org
Suggested-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Diffstat (limited to 'net/sunrpc')
| -rw-r--r-- | net/sunrpc/sysfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c index 49686bf740e6..e638b92b7ad1 100644 --- a/net/sunrpc/sysfs.c +++ b/net/sunrpc/sysfs.c @@ -327,7 +327,7 @@ static ssize_t rpc_sysfs_xprt_switch_add_xprt_store(struct kobject *kobj, { struct rpc_xprt_switch *xprt_switch = rpc_sysfs_xprt_switch_kobj_get_xprt(kobj); - struct xprt_create xprt_create_args; + struct xprt_create xprt_create_args = {}; struct rpc_xprt *xprt, *new; if (!xprt_switch) |