From: Li RongQing <lirongqing@baidu.com>

dmar_latency_disable() intends to zero out only the single
latency_statistic entry for the given type, but the memset size was
computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire
array starting from &lstat[type].

When type > 0, this writes beyond the end of the allocated array,
corrupting adjacent memory.

Fix by using sizeof(*lstat) to clear only the target entry.

Fixes: 55ee5e67a59a ("iommu/vt-d: Add common code for dmar latency performance monitors")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/iommu/intel/perf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
index 02168f2..bec98dc 100644
--- a/drivers/iommu/intel/perf.c
+++ b/drivers/iommu/intel/perf.c
@@ -63,7 +63,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type)
 		return;
 
 	spin_lock_irqsave(&latency_lock, flags);
-	memset(&lstat[type], 0, sizeof(*lstat) * DMAR_LATENCY_NUM);
+	memset(&lstat[type], 0, sizeof(*lstat));
 	spin_unlock_irqrestore(&latency_lock, flags);
 }
 
-- 
2.9.4

On Tue, 21 Jul 2026 17:34:10 +0800, lirongqing wrote:
> dmar_latency_disable() intends to zero out only the single
> latency_statistic entry for the given type, but the memset size was
> computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire
> array starting from &lstat[type].
> 
> When type > 0, this writes beyond the end of the allocated array,
> corrupting adjacent memory.
> 
> [...]

Applied to iommu (fixes), thanks!

[1/1] iommu/intel: fix out-of-bounds memset in dmar_latency_disable()
      https://git.kernel.org/iommu/c/754f8efe45f8

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev