Re: [PATCH net] rxrpc: rxgk: Initialize challenge control message

[Simon Horman]

On Fri, Sep 18, 2026 at 10:57:07PM +0800, Weiming Shi wrote:
> rxgk_challenge_to_recvmsg() copies the complete rxgk_challenge structure
> into an RXRPC_CHALLENGED control message.  The pad member of the embedded
> rxrpc_challenge is not assigned, so the copy can disclose one byte of
> kernel stack memory to userspace.
> 
> Initialize the whole structure before filling its meaningful fields so
> that the reserved byte is always zero.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
> Reported-by: <co+c09f7e87f6209a56@xxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

...