]> git.ipfire.org Git - thirdparty/linux.git/commit
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
authorLi RongQing <lirongqing@baidu.com>
Tue, 21 Jul 2026 09:34:10 +0000 (17:34 +0800)
committerWill Deacon <will@kernel.org>
Tue, 21 Jul 2026 11:34:51 +0000 (11:34 +0000)
commit754f8efe45f87e3a9c6871b645b2f9d46d1b407b
treecf2ddd51eb5ae5a4f3b62f9c28303d02de56f93f
parentfb80117fddb5b477218dc99bb53911b72c3847f8
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

dmar_latency_disable() intends to zero out only the single
latency_statistic entry for the given type, but the memset size was
computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire
array starting from &lstat[type].

When type > 0, this writes beyond the end of the allocated array,
corrupting adjacent memory.

Fix by using sizeof(*lstat) to clear only the target entry.

Fixes: 55ee5e67a59a ("iommu/vt-d: Add common code for dmar latency performance monitors")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Will Deacon <will@kernel.org>
drivers/iommu/intel/perf.c