github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-19 00:58:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mshv_vtl: clear hypercall output before copyout

Browse Source 
mshv_vtl_hvcall_call() copies output_size bytes to userspace.

The output page is freshly allocated. Userspace chooses the copyout length.

If the hypercall writes less, the tail can contain stale page data.

Clear the copied range before issuing the hypercall.

Also check both bounce page allocations before either page is used.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
This commit is contained in:
Yousef Alhouseen 2026-06-25 20:13:14 +02:00 committed by Wei Liu
parent ab96bc97cd
commit b496f042e0
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/hv/mshv_vtl_main.c
View File

@ -1148,12 +1148,22 @@ static int mshv_vtl_hvcall_call(struct mshv_vtl_hvcall_fd *fd,
*/
in = (void *)__get_free_page(GFP_KERNEL);
out = (void *)__get_free_page(GFP_KERNEL);
if (!in || !out) {
ret = -ENOMEM;
goto free_pages;
}
if (copy_from_user(in, (void __user *)hvcall.input_ptr, hvcall.input_size)) {
ret = -EFAULT;
goto free_pages;
}
/*
* The caller supplies output_size, so clear the range copied back to
* userspace in case the hypercall writes fewer bytes than requested.
*/
memset(out, 0, hvcall.output_size);
hvcall.status = hv_do_hypercall(hvcall.control, in, out);
if (copy_to_user((void __user *)hvcall.output_ptr, out, hvcall.output_size)) {