diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2023-02-13 17:32:21 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2023-02-14 23:49:55 +0300 |
| commit | b3551ead616318ea155558cdbe7e91495b8d9b33 (patch) | |
| tree | 9ac199f32398b8bea2cfbbe085a4bc9fcb707ac2 /drivers/iommu | |
| parent | bed9e516f1183faa0e484479701cc669efd9049a (diff) | |
| download | linux-b3551ead616318ea155558cdbe7e91495b8d9b33.tar.xz | |
iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
Missed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.
Cc: stable@vger.kernel.org # 6.1+
Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/iommu')
| -rw-r--r-- | drivers/iommu/iommufd/vfio_compat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iommu/iommufd/vfio_compat.c b/drivers/iommu/iommufd/vfio_compat.c index 8e38bb02d5e1..514494a0025b 100644 --- a/drivers/iommu/iommufd/vfio_compat.c +++ b/drivers/iommu/iommufd/vfio_compat.c @@ -448,7 +448,7 @@ static int iommufd_vfio_iommu_get_info(struct iommufd_ctx *ictx, }; size_t minsz = offsetofend(struct vfio_iommu_type1_info, iova_pgsizes); struct vfio_info_cap_header __user *last_cap = NULL; - struct vfio_iommu_type1_info info; + struct vfio_iommu_type1_info info = {}; struct iommufd_ioas *ioas; size_t total_cap_size; int rc; |