iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
authorJason Gunthorpe <jgg@nvidia.com>
Mon, 13 Feb 2023 14:32:21 +0000 (10:32 -0400)
committerJason Gunthorpe <jgg@nvidia.com>
Tue, 14 Feb 2023 20:49:55 +0000 (16:49 -0400)
commitb3551ead616318ea155558cdbe7e91495b8d9b33
tree9ac199f32398b8bea2cfbbe085a4bc9fcb707ac2
parentbed9e516f1183faa0e484479701cc669efd9049a
iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

Missed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.

Cc: stable@vger.kernel.org # 6.1+
Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/iommu/iommufd/vfio_compat.c