From 5385a5988c8a55bebdc878c05b96648579b5d6e0 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 18 Jan 2019 18:36:03 +0000 Subject: hw/virtio/virtio-balloon: zero-initialize the virtio_balloon_config struct MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In virtio_balloon_get_config() we initialize a struct virtio_balloon_config which we then copy to guest memory. However, the local variable is not zero initialized. This works OK at the moment because we initialize all the fields in it; however an upcoming kernel header change will add some new fields. If we don't zero out the whole struct then we will start leaking a small amount of the contents of QEMU's stack to the guest as soon as we update linux-headers/ to a set of headers that includes the new fields. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daudé Message-id: 20190118183603.24757-1-peter.maydell@linaro.org --- hw/virtio/virtio-balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 1728e4f83a..a12677d4d5 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -311,7 +311,7 @@ out: static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data) { VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); - struct virtio_balloon_config config; + struct virtio_balloon_config config = {}; config.num_pages = cpu_to_le32(dev->num_pages); config.actual = cpu_to_le32(dev->actual); -- cgit v1.2.3