[PATCH] iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

[PATCH] iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

[Jason Gunthorpe]

Missed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.

Cc: stable@vger.kernel.org # 6.1+
Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/iommu/iommufd/vfio_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/vfio_compat.c b/drivers/iommu/iommufd/vfio_compat.c
index 3ceca0e8311c39..dba88ee1d45710 100644
--- a/drivers/iommu/iommufd/vfio_compat.c
+++ b/drivers/iommu/iommufd/vfio_compat.c
@@ -381,7 +381,7 @@ static int iommufd_vfio_iommu_get_info(struct iommufd_ctx *ictx,
 	};
 	size_t minsz = offsetofend(struct vfio_iommu_type1_info, iova_pgsizes);
 	struct vfio_info_cap_header __user *last_cap = NULL;
-	struct vfio_iommu_type1_info info;
+	struct vfio_iommu_type1_info info = {};
 	struct iommufd_ioas *ioas;
 	size_t total_cap_size;
 	int rc;

base-commit: c13a5b88359b9c1791e8713df06a40ed8da88ef8
-- 
2.39.1

RE: [PATCH] iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

[Tian, Kevin]

> From: Jason Gunthorpe <jgg@nvidia.com>
> Sent: Monday, February 13, 2023 10:32 PM
> 
> Missed a zero initialization here. Most of the struct is filled with
> a copy_from_user(), however minsz for that copy is smaller than the
> actual struct by 8 bytes, thus we don't fill the padding.
> 
> Cc: stable@vger.kernel.org # 6.1+
> Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
> Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

Re: [PATCH] iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

[Jason Gunthorpe]

On Mon, Feb 13, 2023 at 10:32:21AM -0400, Jason Gunthorpe wrote:
> Missed a zero initialization here. Most of the struct is filled with
> a copy_from_user(), however minsz for that copy is smaller than the
> actual struct by 8 bytes, thus we don't fill the padding.
> 
> Cc: stable@vger.kernel.org # 6.1+
> Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
> Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/iommu/iommufd/vfio_compat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied

Jason