struct vhost_msg within struct vhost_msg_node is copied to userspace. Unfortunately it turns out on 64 bit systems vhost_msg has padding after type which gcc doesn't initialize, leaking 4 uninitialized bytes to userspace. This padding also unfortunately means 32 bit users of this interface are broken on a 64 bit kernel which will need to be fixed separately.
Unified · Split
| @@ -2345,6 +2345,9 @@ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type) · 2344 unmodified lines | ||
| 2345 | 2345 | struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL); |
| 2346 | 2346 | if (!node) |
| 2347 | 2347 | return NULL; |
| 2348 | + | |
| 2349 | + /* Make sure all padding within the structure is initialized. */ | |
| 2350 | + memset(&node->msg, 0, sizeof node->msg); | |
| 2348 | 2351 | node->vq = vq; |
| 2349 | 2352 | node->msg.type = type; |
| 2350 | 2353 | return node; |