From 14771f30da8fc2ef3047cbe14b3dd3997ed415cb Mon Sep 17 00:00:00 2001 From: Flavio Ceolin Date: Thu, 8 Oct 2026 16:37:54 -0700 Subject: [PATCH] [nrf fromtree] drivers: hwinfo: Avoid kernel memory leak to user z_vrfy_hwinfo_get_reset_cause() and z_vrfy_hwinfo_get_supported_reset_cause() pass an uninitialized stack variable to the implementation and then copy it to the user buffer whatever the implementation returned. In those cases memory from kernel stack are copied to user memory. Signed-off-by: Flavio Ceolin (cherry picked from commit b98e1c75d262ac57fc1e16ceaffece46e2ba8687) --- drivers/hwinfo/hwinfo_handlers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwinfo/hwinfo_handlers.c b/drivers/hwinfo/hwinfo_handlers.c index 9d022c1861a2..1ea6ad3ba678 100644 --- a/drivers/hwinfo/hwinfo_handlers.c +++ b/drivers/hwinfo/hwinfo_handlers.c @@ -26,7 +26,7 @@ int z_vrfy_hwinfo_get_device_eui64(uint8_t *buffer) int z_vrfy_hwinfo_get_reset_cause(uint32_t *cause) { int ret; - uint32_t cause_copy; + uint32_t cause_copy = 0U; ret = z_impl_hwinfo_get_reset_cause(&cause_copy); K_OOPS(k_usermode_to_copy(cause, &cause_copy, sizeof(uint32_t))); @@ -45,7 +45,7 @@ int z_vrfy_hwinfo_clear_reset_cause(void) int z_vrfy_hwinfo_get_supported_reset_cause(uint32_t *supported) { int ret; - uint32_t supported_copy; + uint32_t supported_copy = 0U; ret = z_impl_hwinfo_get_supported_reset_cause(&supported_copy); K_OOPS(k_usermode_to_copy(supported, &supported_copy, sizeof(uint32_t)));