Thread (4 messages) flat view 4 messages, 4 authors, 2026-06-03
STALE98d

[PATCH] sunrpc: fix uninitialized xprt_create_args structure

From: Hongling Zeng <hidden>
Date: 2026-06-02 08:32:14
Also in: linux-nfs, stable
Subsystem: kernel nfsd, sunrpc, and lockd servers, networking [general], nfs, sunrpc, and lockd clients, the rest · Maintainers: Chuck Lever, Jeff Layton, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Trond Myklebust, Anna Schumaker, Linus Torvalds

The xprt_create_args structure is allocated on the stack without
initialization in rpc_sysfs_xprt_switch_add_xprt_store(). While some
fields are manually populated, critical fields like srcaddr, bc_xps,
and flags contain uninitialized stack garbage.

This can lead to:
1. Kernel panic when xs_setup_xprt() dereferences garbage srcaddr
2. Information leak if srcaddr points to sensitive stack data
3. Unpredictable behavior if flags has random bits set

The fix is to zero-initialize the structure to ensure all unused
fields are NULL/0, preventing the transport setup code from acting
on garbage data.

Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <redacted>
---
 net/sunrpc/sysfs.c | 1 +
 1 file changed, 1 insertion(+)
diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c
index a90480f80154..0a99d0f1eb4c 100644
--- a/net/sunrpc/sysfs.c
+++ b/net/sunrpc/sysfs.c
@@ -333,6 +333,7 @@ static ssize_t rpc_sysfs_xprt_switch_add_xprt_store(struct kobject *kobj,
 	if (!xprt_switch)
 		return 0;
 
+	memset(&xprt_create_args, 0, sizeof(xprt_create_args));
 	xprt = rpc_xprt_switch_get_main_xprt(xprt_switch);
 	if (!xprt)
 		goto out;
-- 
2.25.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help