diff options
| author | Christian Borntraeger <borntraeger@linux.ibm.com> | 2026-08-05 13:04:49 +0200 |
|---|---|---|
| committer | Claudio Imbrenda <imbrenda@linux.ibm.com> | 2026-08-11 10:45:26 +0200 |
| commit | 4e2c7f7cbc27418f9a290399b986c1b85ff93b90 (patch) | |
| tree | bdf9b25c827ff5d2b1a20483cbe662bde67a36b6 /scripts/const_structs.checkpatch | |
| parent | b98014e98e0842b498506d9b3060bf1707ed0739 (diff) | |
| download | linux-4e2c7f7cbc27418f9a290399b986c1b85ff93b90.tar.gz linux-4e2c7f7cbc27418f9a290399b986c1b85ff93b90.zip | |
KVM: s390: Zero initialize data structures for inject_pfault_token
__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of
the on-stack struct kvm_s390_irq but the full ext substructure is copied
into the cpu local variable on inject. ext_params and pad contain stale
stack values.
Interrupt delivery only uses ext_params2, so nothing leaks to the guest,
but a host user can use the migration ioctls to get to the data.
Fix by zero-initializing the irq struct.
Do the same for the inti data structure.
Fixes: 383d0b050106 ("KVM: s390: handle pending local interrupts via bitmap")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-3-borntraeger@linux.ibm.com>
Diffstat (limited to 'scripts/const_structs.checkpatch')
0 files changed, 0 insertions, 0 deletions