Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2018年04月28日 09:51, Kevin Easton wrote:
On Fri, Apr 27, 2018 at 09:07:56PM -0400, Kevin Easton wrote:
On Fri, Apr 27, 2018 at 07:05:45PM +0300, Michael S. Tsirkin wrote:
On Fri, Apr 27, 2018 at 11:45:02AM -0400, Kevin Easton wrote:
The struct vhost_msg within struct vhost_msg_node is copied to userspace,
so it should be allocated with kzalloc() to ensure all structure padding
is zeroed.

Signed-off-by: Kevin Easton <kevin@xxxxxxxxxxx>
Reported-by: syzbot+87cfa083e727a224754b@xxxxxxxxxxxxxxxxxxxxxxxxx
Does it help if a patch naming the padding is applied,
and then we init just the relevant field?
Just curious.
No, I don't believe that is sufficient to fix the problem.
Scratch that, somehow I missed the "..and then we init just the
relevant field" part, sorry.

There's still the padding after the vhost_iotlb_msg to consider.  It's
named in the union but I don't think that's guaranteed to be initialised
when the iotlb member of the union is used to initialise things.

I didn't name the padding in my original patch because I wasn't sure
if the padding actually exists on 32 bit architectures?
This might still be a conce

Yes.

print &((struct vhost_msg *)0)->iotlb
$3 = (struct vhost_iotlb_msg *) 0x4



At the end of the day, zeroing 96 bytes (the full size of vhost_msg_node)
is pretty quick.

     - Kevin

Right, and even if it may be used heavily in the data-path, zeroing is not the main delay in that path.

Thanks



[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux