Commit 5b17f3f34391 for kernel

commit 5b17f3f34391372faf03e79d947e0c50ab6dd258
Author: George Wilson <gcwilson@linux.ibm.com>
Date:   Fri Aug 7 11:56:21 2026 -0500

    powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

    In papr_phy_attest_create_handle(), the params->cmd.length is not
    validated before use, which can result in a buffer overlow.  Check it and
    return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).

    Also, params is freed on the success path but not error. Free it on
    errors after memory allocation.  And free it on negative fd.

    Fixes: 86900ab620a4 ("powerpc/pseries: Add a char driver for physical-attestation RTAS")
    Acked-by: Haren Myneni <haren@linux.ibm.com>
    Acked-by: Nayna Jain <nayna@linux.ibm.com>
    Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
    Cc: stable@vger.kernel.org # 6.16
    Signed-off-by: George Wilson <gcwilson@linux.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/platforms/pseries/papr-phy-attest.c b/arch/powerpc/platforms/pseries/papr-phy-attest.c
index 20a0e1581302..350ba26e5962 100644
--- a/arch/powerpc/platforms/pseries/papr-phy-attest.c
+++ b/arch/powerpc/platforms/pseries/papr-phy-attest.c
@@ -230,10 +230,17 @@ static long papr_phy_attest_create_handle(struct papr_phy_attest_io_block __user
 		return -ENOMEM;

 	if (copy_from_user(&params->cmd, ulc,
-			sizeof(struct papr_phy_attest_io_block)))
+			sizeof(struct papr_phy_attest_io_block))) {
+		kfree(params);
 		return -EFAULT;
+	}

 	params->cmd_len = be32_to_cpu(params->cmd.length);
+	if (params->cmd_len == 0 || params->cmd_len > sizeof(params->cmd)) {
+		kfree(params);
+		return -EINVAL;
+	}
+
 	seq = (struct papr_rtas_sequence) {
 		.begin = phy_attest_sequence_begin,
 		.end = phy_attest_sequence_end,
@@ -246,6 +253,9 @@ static long papr_phy_attest_create_handle(struct papr_phy_attest_io_block __user
 			&papr_phy_attest_handle_ops,
 			"[papr-physical-attestation]");

+	if (fd < 0)
+		kfree(params);
+
 	return fd;
 }