diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2019-01-18 18:36:03 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-01-21 17:20:36 +0000 |
| commit | 5385a5988c8a55bebdc878c05b96648579b5d6e0 (patch) | |
| tree | ceaeae9a04d4fb85a6ad3af35ae0f70102790f3f /hw/virtio/virtio-balloon.c | |
| parent | cce871c504694cf1034adf525556e3ca3c7eebb6 (diff) | |
hw/virtio/virtio-balloon: zero-initialize the virtio_balloon_config struct
In virtio_balloon_get_config() we initialize a struct virtio_balloon_config
which we then copy to guest memory. However, the local variable is not
zero initialized. This works OK at the moment because we initialize
all the fields in it; however an upcoming kernel header change will
add some new fields. If we don't zero out the whole struct then we
will start leaking a small amount of the contents of QEMU's stack
to the guest as soon as we update linux-headers/ to a set of headers
that includes the new fields.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190118183603.24757-1-peter.maydell@linaro.org
Diffstat (limited to 'hw/virtio/virtio-balloon.c')
| -rw-r--r-- | hw/virtio/virtio-balloon.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 1728e4f83a..a12677d4d5 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -311,7 +311,7 @@ out: static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data) { VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); - struct virtio_balloon_config config; + struct virtio_balloon_config config = {}; config.num_pages = cpu_to_le32(dev->num_pages); config.actual = cpu_to_le32(dev->actual); |