Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: 2018-05-07 13:03:25
Subsystem:
the rest, virtio host (vhost) · Maintainers:
Linus Torvalds, "Michael S. Tsirkin", Jason Wang
Possibly related (same subject, not in this thread)
- 2018-05-07 · Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node · Dmitry Vyukov via Virtualization <hidden>
- 2018-04-29 · Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node · Dmitry Vyukov via Virtualization <hidden>
- 2018-04-28 · Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node · Jason Wang <hidden>
- 2018-04-27 · Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node · "Michael S. Tsirkin" <mst@redhat.com>
- 2018-04-27 · Re: [PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node · Dmitry Vyukov via Virtualization <hidden>
On Fri, Apr 27, 2018 at 11:45:02AM -0400, Kevin Easton wrote:
quoted hunk
The struct vhost_msg within struct vhost_msg_node is copied to userspace, so it should be allocated with kzalloc() to ensure all structure padding is zeroed. Signed-off-by: Kevin Easton <redacted> Reported-by: syzbot+87cfa083e727a224754b@syzkaller.appspotmail.com --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index f3bd8e9..1b84dcff 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c@@ -2339,7 +2339,7 @@ EXPORT_SYMBOL_GPL(vhost_disable_notify); /* Create a new message. */ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type) { - struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL); + struct vhost_msg_node *node = kzalloc(sizeof *node, GFP_KERNEL); if (!node) return NULL; node->vq = vq;
Let's just init the msg though. OK it seems this is the best we can do for now, we need a new feature bit to fix it for 32 bit userspace on 64 bit kernels. Does the following help? Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index f3bd8e9..58d9aec 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c@@ -2342,6 +2342,9 @@ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type) struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL); if (!node) return NULL; + + /* Make sure all padding within the structure is initialized. */ + memset(&node->msg, 0, sizeof node->msg); node->vq = vq; node->msg.type = type; return node;