[PATCH net] rxrpc: rxgk: Initialize challenge control message

[Weiming Shi]

rxgk_challenge_to_recvmsg() copies the complete rxgk_challenge structure
into an RXRPC_CHALLENGED control message.  The pad member of the embedded
rxrpc_challenge is not assigned, so the copy can disclose one byte of
kernel stack memory to userspace.

Initialize the whole structure before filling its meaningful fields so
that the reserved byte is always zero.

Cc: stable at vger.kernel.org
Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Reported-by: <co+c09f7e87f6209a56 at bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs at gmail.com>
---
 net/rxrpc/rxgk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index 77a67ace1d248..799772b0d8472 100644
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -756,7 +756,7 @@ static int rxgk_challenge_to_recvmsg(struct rxrpc_connection *conn,
 				     struct sk_buff *challenge,
 				     struct msghdr *msg)
 {
-	struct rxgk_challenge chall;
+	struct rxgk_challenge chall = {};
 
 	chall.base.service_id		= conn->service_id;
 	chall.base.security_index	= conn->security_ix;
-- 
2.55.0