From: Peter Maydell Date: Fri, 18 Jan 2019 18:36:03 +0000 (+0000) Subject: hw/virtio/virtio-balloon: zero-initialize the virtio_balloon_config struct X-Git-Tag: v3.1.1~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f0a334345ba5a9102fd55c523d75caa1fd618e06;p=thirdparty%2Fqemu.git hw/virtio/virtio-balloon: zero-initialize the virtio_balloon_config struct In virtio_balloon_get_config() we initialize a struct virtio_balloon_config which we then copy to guest memory. However, the local variable is not zero initialized. This works OK at the moment because we initialize all the fields in it; however an upcoming kernel header change will add some new fields. If we don't zero out the whole struct then we will start leaking a small amount of the contents of QEMU's stack to the guest as soon as we update linux-headers/ to a set of headers that includes the new fields. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daudé Message-id: 20190118183603.24757-1-peter.maydell@linaro.org (cherry picked from commit 5385a5988c8a55bebdc878c05b96648579b5d6e0) Signed-off-by: Michael Roth --- diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 1728e4f83af..a12677d4d5b 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -311,7 +311,7 @@ out: static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data) { VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); - struct virtio_balloon_config config; + struct virtio_balloon_config config = {}; config.num_pages = cpu_to_le32(dev->num_pages); config.actual = cpu_to_le32(dev->actual);