[PATCH v2] habanalabs: fix information leak in sec_attest_info()

From: Xingyuan Mo <hdthky0@gmail.com>
To: Oded Gabbay <ogabbay@kernel.org>, Ofir Bitton <obitton@habana.ai>,
	Tomer Tayar <ttayar@habana.ai>,
	Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>,
	Moti Haimovski <mhaimovski@habana.ai>,
	Dafna Hirschfeld <dhirschfeld@habana.ai>,
	dri-devel@lists.freedesktop.org (open list:HABANALABS PCI DRIVER)
Cc: Xingyuan Mo <hdthky0@gmail.com>
Subject: [PATCH v2] habanalabs: fix information leak in sec_attest_info()
Date: Fri,  8 Dec 2023 21:00:59 +0800	[thread overview]
Message-ID: <20231208130059.424735-1-hdthky0@gmail.com> (raw)

This function may copy the pad0 field of struct hl_info_sec_attest to user
mode which has not been initialized, resulting in leakage of kernel heap
data to user mode. To prevent this, use kzalloc() to allocate and zero out
the buffer, which can also eliminate other uninitilized holes, if any.

Fixes: 0c88760f8f5e ("habanalabs/gaudi2: add secured attestation info uapi")
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
---
 drivers/accel/habanalabs/common/habanalabs_ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/habanalabs/common/habanalabs_ioctl.c b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
index 8ef36effb95b..a7cd625d82c0 100644
--- a/drivers/accel/habanalabs/common/habanalabs_ioctl.c
+++ b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
@@ -685,7 +685,7 @@ static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args)
 	if (!sec_attest_info)
 		return -ENOMEM;
 
-	info = kmalloc(sizeof(*info), GFP_KERNEL);
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (!info) {
 		rc = -ENOMEM;
 		goto free_sec_attest_info;
-- 
2.34.1

