Messages in this thread | | | Date | Wed, 31 Aug 2022 11:12:28 -0400 | From | "Michael S. Tsirkin" <> | Subject | Re: [PATCH v2] vduse: prevent uninitialized memory accesses |
| |
On Wed, Aug 31, 2022 at 05:01:11PM +0200, Maxime Coquelin wrote: > On 8/29/22 09:48, Greg KH wrote: > > On Mon, Aug 29, 2022 at 09:34:24AM +0200, Maxime Coquelin wrote: > > > If the VDUSE application provides a smaller config space > > > than the driver expects, the driver may use uninitialized > > > memory from the stack. > > > > > > This patch prevents it by initializing the buffer passed by > > > the driver to store the config value. > > > > > > This fix addresses CVE-2022-2308. > > > > > > Cc: xieyongji@bytedance.com > > > Cc: stable@vger.kernel.org # v5.15+ > > > Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") > > > > > > Acked-by: Jason Wang <jasowang@redhat.com> > > > Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> > > > > Please no blank line above the Acked-by: line here if possible. > > Sure. > > Jason, do you prefer I post a new revision with this single change or > you will handle it while applying? Either way is fine to me. > > Thanks, > Maxime
Repost pls, easier.
> > thanks, > > > > greg k-h > >
| |