On Tue, 2015-08-25 at 15:47 +0800, Jason Wang wrote: > All fields of kvm_io_range were initialized or copied explicitly > afterwards. So switch to use kmalloc(). Is there any compiler added alignment padding in either structure? If so, those padding areas would now be uninitialized and may leak kernel data if copied to user-space. > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c [] > @@ -3248,7 +3248,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, > if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1) > return -ENOSPC; > > - new_bus = kzalloc(sizeof(*bus) + ((bus->dev_count + 1) * > + new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count + 1) * > sizeof(struct kvm_io_range)), GFP_KERNEL); > if (!new_bus) > return -ENOMEM; > @@ -3280,7 +3280,7 @@ int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, > if (r) > return r; > > - new_bus = kzalloc(sizeof(*bus) + ((bus->dev_count - 1) * > + new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * > sizeof(struct kvm_io_range)), GFP_KERNEL); > if (!new_bus) > return -ENOMEM; -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
