Skip to content
Commit b3551ead authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

Missed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.

Cc: stable@vger.kernel.org # 6.1+
Fixes: d624d665 ("iommufd: vfio container FD ioctl compatibility")
Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvidia.com


Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reported-by: default avatar <syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent bed9e516
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment