On Wed, Aug 09, 2023 at 05:02:46PM -0400, Stefan Hajnoczi wrote:
> diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
> index de675d799c7d..ffab3536dc8a 100644
> --- a/drivers/gpu/drm/i915/gvt/kvmgt.c
> +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
> @@ -1382,7 +1382,7 @@ static long intel_vgpu_ioctl(struct vfio_device *vfio_dev, unsigned int cmd,
> intel_gvt_reset_vgpu(vgpu);
> return 0;
> } else if (cmd == VFIO_DEVICE_QUERY_GFX_PLANE) {
> - struct vfio_device_gfx_plane_info dmabuf;
> + struct vfio_device_gfx_plane_info dmabuf = {};
> int ret = 0;
>
> minsz = offsetofend(struct vfio_device_gfx_plane_info,
> @@ -1392,6 +1392,8 @@ static long intel_vgpu_ioctl(struct vfio_device *vfio_dev, unsigned int cmd,
> if (dmabuf.argsz < minsz)
> return -EINVAL;
>
> + minsz = min(minsz, sizeof(dmabuf));
> +
Huh?
minsz = min(sizeof(dmabuf), dmabuf.argsz)
> ret = intel_vgpu_query_plane(vgpu, &dmabuf);
> if (ret != 0)
> return ret;
> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
> index c6c6b5d26670..ee42a780041f 100644
> --- a/samples/vfio-mdev/mbochs.c
> +++ b/samples/vfio-mdev/mbochs.c
> @@ -1262,7 +1262,7 @@ static long mbochs_ioctl(struct vfio_device *vdev, unsigned int cmd,
>
> case VFIO_DEVICE_QUERY_GFX_PLANE:
> {
> - struct vfio_device_gfx_plane_info plane;
> + struct vfio_device_gfx_plane_info plane = {};
>
> minsz = offsetofend(struct vfio_device_gfx_plane_info,
> region_index);
> @@ -1273,11 +1273,13 @@ static long mbochs_ioctl(struct vfio_device *vdev, unsigned int cmd,
> if (plane.argsz < minsz)
> return -EINVAL;
>
> + outsz = min_t(unsigned long, plane.argsz, sizeof(plane));
> +
This one is right
Jason
