Date:   Fri, 7 Jan 2022 10:34:07 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     "Rafael J. Wysocki" <rafael@kernel.org>,
        Chen Yu <yu.c.chen@intel.com>
Cc:     Len Brown <lenb@kernel.org>, linux-acpi@vger.kernel.org,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] ACPI: pfr_telemetry: Fix info leak in pfrt_log_ioctl()
Message-ID: <20220107073407.GG22086@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?dnHlmsr628+T7sCDgD4KvgLKVMpYG2MkZIQbkjbFlesbfJ4wSqNvJIQvOpTk?=
 =?us-ascii?Q?C/ZsTafTEEzw6qJD3ZY2hBo9MTBbVzA+kWWakBrlGtnTc5uXZIafG9VghiQ9?=
 =?us-ascii?Q?jEvD6vaZJZkw6KdX+5XT1m+oQFikzGrm87O+RPHgRoqOlaszr1xp2LLriEHv?=
 =?us-ascii?Q?pyAaNekKAZZMKOR5zJ/1VuSmWUav075G115SDedx2T5hudf0yhILJzLAQUin?=
 =?us-ascii?Q?CNBPjPgobbjNPHmbmCPDy3KsRM17f1qEEYQCYV2VXSILgoH3U1jCgjwArjWn?=
 =?us-ascii?Q?GRIvyBcHz9qJr4vojyKbIsh4LWsI5ORJvo0d5IuKuEuUBBG6WOvetIjaUMft?=
 =?us-ascii?Q?sXITj73iMVTo4VXjinkGEaMrtwfpDHdK0tzL1JsxDhnq1fZRcfpOvsQjArKX?=
 =?us-ascii?Q?+kZSbB6z6vsTcvlSCDwtPvUxQbar9gYcAEJ1ZF7v65lo2zGJ72ckNXUoZWTf?=
 =?us-ascii?Q?/fnycE8pB10Klw312MMG8II8QXDn92OghAS8khIFSCSeGgB01VJos27hAVOn?=
 =?us-ascii?Q?WhvMc6R+aRwsaOXhpTTed2XfCQ6SdDYtxpUfAg9F/QeeErfIy56zOh6MVZRZ?=
 =?us-ascii?Q?gyp2nSRtl+gYsIbAmfDmUxGJPrhgQdX5o8DGrrPKhD9hJSD5pI1Ny+T0nqSB?=
 =?us-ascii?Q?FCvziN3NPBPwtO7yFeze+GyFOasK5FFPf9hHzh9aVBYwPIqXuWYn8C04smwV?=
 =?us-ascii?Q?IqsSS5Gmx/unlQB3NU9FqTUvvmfGlLCmgekTcSOwiuTsYlLij29cM5bNHXod?=
 =?us-ascii?Q?RWlH5/Sfe7aMPdQY6P6Ur3EfSWr967gXBiLBmwNY2r334cwu4iUL4ttj4I4t?=
 =?us-ascii?Q?V5mZp8Ho9eRtg4aMzJO1ma6CR+Iz3Y8QeE4Lk302fqESJzNl86CvXCwBcOKe?=
 =?us-ascii?Q?wCsMJUrKQ6DBhFKf9ketBtHAM0TChzM+ZSk6wqaOyl+IBajvmZdIqXj/WGl1?=
 =?us-ascii?Q?b9ZILDqmyLwZxNIvqjkAGA//eBTEPIUujmKvqyuL77rL5Wq4rcKtUzB/Lwek?=
 =?us-ascii?Q?AKnF/Hkj/69qjhF7zUyR5ddZmq+mw9NVdeYjtQzAU3zjz8fy6AqBX7oKGnA0?=
 =?us-ascii?Q?ONKPRiKgVaakaUlaeVYJXLPCJNAou/EaV+yqp3TNO4FipuNuW+RS1LiJklnc?=
 =?us-ascii?Q?put4QxcxwT/sUr1XnFL7iIAlmBPv0UyQd5gxfAUv+KH77pPuhb0uyEDur+Nj?=
 =?us-ascii?Q?XqFt3O+46i8GUaysto4mGZeuB6rBteW5CbGuEyF4KjaIC6r/OaxW4bXLpQLA?=
 =?us-ascii?Q?TptbZvXrAWpNK3MPVHkXh7mQS/y8Vd8duAiou0zXb8KTGTb3e6GoxwEU8hQt?=
 =?us-ascii?Q?kob3pa+pxiOvVGvkZnMCwLrFPuu2qE8udarXPBlH409q9McH6+AgX/h3kn0d?=
 =?us-ascii?Q?rdL1dnCNkgpGj3nKNz/5Z1n06m06POfqcuMCqEAPWyJPfxrzkGFre7zB9isw?=
 =?us-ascii?Q?DtzGhEjyPleAVLatLisJMyi6MoFOXzoYWbG1Iqp0rzythsofpt6bgA5zs7RF?=
 =?us-ascii?Q?mVU5S4/wDx22H4XthkWLccV1hi5ltWKZyXgWlmjhOORKljHO9/RA4+h1sr2Q?=
 =?us-ascii?Q?u0mGRBAdkfpI4vFm9GqOjJ00MAprY87KWHMM1BEGEsy/Z3JSqKU0iqfvcbej?=
 =?us-ascii?Q?KLA3ddh1yBoG+Q4H5eGhfR5/QDfwlOiQyHCIhLEgi27v5mvfueYZZCjGUWLL?=
 =?us-ascii?Q?fpuXMS09G26+ZbFqf4pShFRdH1Y=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f3d98a26-1fdc-4e22-2942-08d9d1b01d3e
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2022 07:34:18.5635
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tDToMSzQEX+T7gbw7vdB/g3XRIFkcq29VYbNZ0K8XmrdnnO2Z0K5BU1H/npLzXPJJHnahevuazbSWqNH0k6JTMbscY7wAYycT6ZDkt5GGIM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB5752
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10219 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 malwarescore=0
 mlxlogscore=999 adultscore=0 suspectscore=0 mlxscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2201070053
X-Proofpoint-ORIG-GUID: y0EA88hfT8teSFG4j_1XdOPq8cAF05Rv
X-Proofpoint-GUID: y0EA88hfT8teSFG4j_1XdOPq8cAF05Rv
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The "data_info" struct is copied to the user.  It has a 4 byte struct
hole after the last struct member so we need to memset that to avoid
copying uninitialized stack data to the user.

Fixes: b0013e037a8b ("ACPI: Introduce Platform Firmware Runtime Telemetry driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
When you're adding a new driver to the kernel then please use the new
driver's prefix instead of just the subsystem prefix.

 Bad: ACPI: Introduce Platform Firmware Runtime Telemetry driver
Good: ACPI / pfr_telemetry: Introduce Platform Firmware Runtime Telemetry driver

Otherwise it's just up to me to guess what prefix you wanted.

 drivers/acpi/pfr_telemetry.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/pfr_telemetry.c b/drivers/acpi/pfr_telemetry.c
index da50dd80192c..9abf350bd7a5 100644
--- a/drivers/acpi/pfr_telemetry.c
+++ b/drivers/acpi/pfr_telemetry.c
@@ -83,6 +83,7 @@ static int get_pfrt_log_data_info(struct pfrt_log_data_info *data_info,
 	union acpi_object *out_obj, in_obj, in_buf;
 	int ret = -EBUSY;
 
+	memset(data_info, 0, sizeof(*data_info));
 	memset(&in_obj, 0, sizeof(in_obj));
 	memset(&in_buf, 0, sizeof(in_buf));
 	in_obj.type = ACPI_TYPE_PACKAGE;
-- 
2.20.1