From da3a98c941753255418616d249e5b40db0927c26 Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Wed, 10 Jun 2026 16:03:52 -0700 Subject: [PATCH] mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str ipaq_micro_str() decodes a UTF-16LE string into an ASCII string. It copies characters to a stack buffer retstr, but fails to null-terminate it. When kstrdup() is called on retstr, it can read past the buffer into uninitialized stack memory, potentially leaking stack contents. Fix this by initializing retstr to zero. Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/aintJF4X5tWDW-Ej@google.com Signed-off-by: Lee Jones --- drivers/mfd/ipaq-micro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mfd/ipaq-micro.c b/drivers/mfd/ipaq-micro.c index 4b757d847282..5146a6eb0e5a 100644 --- a/drivers/mfd/ipaq-micro.c +++ b/drivers/mfd/ipaq-micro.c @@ -221,7 +221,7 @@ static void ipaq_micro_eeprom_read(struct ipaq_micro *micro, static char *ipaq_micro_str(u8 *wchar, u8 len) { - char retstr[256]; + char retstr[256] = { 0 }; u8 i; for (i = 0; i < len / 2; i++)