On Fri, Apr 27, 2018 at 09:07:56PM -0400, Kevin Easton wrote:
> On Fri, Apr 27, 2018 at 07:05:45PM +0300, Michael S. Tsirkin wrote:
> > On Fri, Apr 27, 2018 at 11:45:02AM -0400, Kevin Easton wrote:
> > > The struct vhost_msg within struct vhost_msg_node is copied to userspace,
> > > so it should be allocated with kzalloc() to ensure all structure padding
> > > is zeroed.
> > >
> > > Signed-off-by: Kevin Easton <ke...@guarana.org>
> > > Reported-by: syzbot+87cfa083e727a2247...@syzkaller.appspotmail.com
> >
> > Does it help if a patch naming the padding is applied,
> > and then we init just the relevant field?
> > Just curious.
>
> No, I don't believe that is sufficient to fix the problem.
Scratch that, somehow I missed the "..and then we init just the
relevant field" part, sorry.
There's still the padding after the vhost_iotlb_msg to consider. It's
named in the union but I don't think that's guaranteed to be initialised
when the iotlb member of the union is used to initialise things.
> I didn't name the padding in my original patch because I wasn't sure
> if the padding actually exists on 32 bit architectures?
This might still be a concern, too?
At the end of the day, zeroing 96 bytes (the full size of vhost_msg_node)
is pretty quick.
- Kevin
