Re: [PATCH] iommu/intel: fix out-of-bounds memset in dmar_latency_disable()
Will Deacon <[email protected]>
| Newsgroups | dev.linux.lists.iommu,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 21 Jul 2026 17:34:10 +0800, lirongqing wrote:
> dmar_latency_disable() intends to zero out only the single
> latency_statistic entry for the given type, but the memset size was
> computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire
> array starting from &lstat[type].
>
> When type > 0, this writes beyond the end of the allocated array,
> corrupting adjacent memory.
>
> [...]
Applied to iommu (fixes), thanks!
[1/1] iommu/intel: fix out-of-bounds memset in dmar_latency_disable()
https://git.kernel.org/iommu/c/754f8efe45f8
Cheers,
--
Will
https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev