VFIO fix for v6.10
- Recent stable backports are exposing a bug introduced in the v6.10 development cycle where a counter value is uninitialized. This leads to regressions in userspace drivers like QEMU where where the kernel might ask for an arbitrary buffer size or return out of memory itself based on a bogus value. Zero initialize the counter. (Yi Liu) -----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmaOwiUbHGFsZXgud2ls bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiVnoP/iAThUwMs8fQImRUXtZ5 jcZ3ROFZieB6CywjQEswy7G/Q9F4yNgHSwcu7VD/i44q5j88HqGDf3iZ3LPEMGSm GHrC9ynmJWqjN5Se7kGaKDGZFxxF9P2vTxfTkSG40qkP11obmCUIsWr4IHe4IH0r YcKEawW92G/mp9wEPWidDJYmRy7MZe/SJMbWaF3uwDymjqJA9WJjh2QS3tiPwAc+ xbkdgYk9JyLe0/U0uawV0jgxvqzEM+rTw4hZRmPl7Aygi7qYx1iGnzEHd5QOGZSJ pHPfXe0EFIY+341y0AKwezDb4Vx8+F7M0Z+xx/v1zD875y/ffCT6lX79sDzIK/MC zzSzLj/64S40i8sai7Ec7t5W7PlNkXurnOjBa6k3EcfOmxYr0qcQzHgDgenUeNPL taybZN42RqYs3TIafRtu9vScOVpDn3H/BoSwlsdEKFqUqLA/g1B7U2EPyNRVWNWR By0WzJTWDnhltyTrxWJ9FfuehVlXtB91ovO5Cerh4DlOdcLkJD6RfESjaOdBRf0+ vuqfstHYQ+7nH91n9101AKKTUQEGAVh3Lp/HgLKjI/wXua4lO+1/DmFA9mlJ/H/Y HcIZk3flq+Bab7TvmORwDU5UjrDofu4dvp3mhFpBByvjNKKlo0mmD5Boyj7RIi+a vKc3rgBpL490/V//iengWDSr =syRE -----END PGP SIGNATURE----- Merge tag 'vfio-v6.10' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Recent stable backports are exposing a bug introduced in the v6.10 development cycle where a counter value is uninitialized. This leads to regressions in userspace drivers like QEMU where where the kernel might ask for an arbitrary buffer size or return out of memory itself based on a bogus value. Zero initialize the counter. (Yi Liu) * tag 'vfio-v6.10' of https://github.com/awilliam/linux-vfio: vfio/pci: Init the count variable in collecting hot-reset devices
This commit is contained in:
commit
d6e1712b78
1 changed files with 1 additions and 1 deletions
|
@ -1260,7 +1260,7 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info(
|
|||
struct vfio_pci_hot_reset_info hdr;
|
||||
struct vfio_pci_fill_info fill = {};
|
||||
bool slot = false;
|
||||
int ret, count;
|
||||
int ret, count = 0;
|
||||
|
||||
if (copy_from_user(&hdr, arg, minsz))
|
||||
return -EFAULT;
|
||||
|
|
Loading…
Reference in a new issue