diff options
| author | Yufeng Wang <wangyufeng@kylinos.cn> | 2026-06-26 15:04:38 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2026-08-03 23:08:17 -0400 |
| commit | d914650e946d137fb58dbb75fe476de295595097 (patch) | |
| tree | 4030dcb1a6074b26b1fb7e55dccd611aeaef3a90 /scripts/Makefile.thinlto | |
| parent | 46d447d703a8ce3f46352c71c7b281c99e416bc3 (diff) | |
| download | linux-next-d914650e946d137fb58dbb75fe476de295595097.tar.gz linux-next-d914650e946d137fb58dbb75fe476de295595097.zip | |
vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
The clear_user() call in VHOST_GET_FEATURES_ARRAY incorrectly starts
at argp, which is the beginning of the features array, overwriting the
data just written by copy_to_user(). It should start after the copied
elements at argp + copied * sizeof(u64) to only zero the trailing
unused space.
Use size_mul() for both the offset and length calculations so the
arithmetic stays consistent with the surrounding code and remains
overflow-safe.
Fixes: 333c515d1896 ("vhost-net: allow configuring extended features")
Signed-off-by: Yufeng Wang <wangyufeng@kylinos.cn>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260626070438.59149-1-r4o5m6e8o@163.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions