vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR.
Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Mario Casquero <[email protected]> Link: https://lore.kernel.org/qemu-devel/[email protected] Signed-off-by: Cédric Le Goater <[email protected]> --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 68ee3ce7dc254dd045ed2c1b21bebc53a4b4e3d6..6b04c6f94f9ade765e236d457e4828ac6199680a 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1143,7 +1143,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.54.0
