From nobody Sat Jul 25 00:55:18 2026 Received: from outbound.baidu.com (mx16.baidu.com [111.202.115.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3508844998C for ; Tue, 21 Jul 2026 09:36:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=111.202.115.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784626608; cv=none; b=oZlclUm2ufSCrpEQhdvNQDIB+Z7UmDeS/EwUW02oUOJsvfdAWjCMcpY10LZ0ijTW4Ndwc+Ut0NxQcgRASGXIwAYz83HKS70SkYSuWaRJLS6A0+7VFZwSCKeAWv0i5gSIfhPWfcoKscAfJe4625rgjiDjngs79+4WGCY5tJ+EybM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784626608; c=relaxed/simple; bh=3ocY3LuxVGOzuZ5oLTc06Yv6aTa8QcQV0dt7Jn9m7qE=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=A+Di/e7p8i81lv2IOsVyEW5GlgxxVRQdaVOfA1QwsCQybwqkAoxdyqCS8Vb9nEaUtUWWlmgrJkV4J3aUSmIBAunJiYYlHS9gxbq8QJegWy6Br5DGcMsXcqTFVi8fEZ+iFUdHCwXttBDMUeJBIFZ+2yYu7sTeZ+3Uh74VnXGSFOQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com; spf=pass smtp.mailfrom=baidu.com; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b=TYqqRocx; arc=none smtp.client-ip=111.202.115.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=baidu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b="TYqqRocx" X-MD-Sfrom: lirongqing@baidu.com X-MD-SrcIP: 172.31.50.47 From: lirongqing To: David Woodhouse , Lu Baolu , Joerg Roedel , Will Deacon , Robin Murphy , , CC: Li RongQing Subject: [PATCH] iommu/intel: fix out-of-bounds memset in dmar_latency_disable() Date: Tue, 21 Jul 2026 17:34:10 +0800 Message-ID: <20260721093410.2465-1-lirongqing@baidu.com> X-Mailer: git-send-email 2.17.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: bjkjy-exc10.internal.baidu.com (172.31.50.20) To bjkjy-exc3.internal.baidu.com (172.31.50.47) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baidu.com; s=selector1; t=1784626462; bh=GaD1oGhEMrfBVdwD5WLzMvPeXBXtgS8uA/yLsA4ODlU=; h=From:To:CC:Subject:Date:Message-ID:Content-Type; b=TYqqRocxA89iitEktZUNpPTgvOy8DxRPIbQPdp73WoJgP4ehoX5rzFoEkSGXw2H3i C9R9ZnJVwrV3l3BbqAkzjHtRYncBu15MBgKL/VUnHW9nUmmAUIceYCSXHl093uGPYH Ecltr5+kJoA9s8iwXgZJFneLaGeoXkgLnTO9SkdlnP2n7GQlY3N3oqguSkPsR7/j7x IkkNHg+9UVsvu0OUc+ofEkT3CMtl04dCA0dAF5cJobF8amhR5is0te6cCH70MSQdbA yWj3xq3O9aFVc49OCAHVsNx/pzygmSoyk5d7IDAm7gnmuJbgTJHjNsKQ6/hEsdAdqe NUPm8Ok+Dxf6A== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li RongQing dmar_latency_disable() intends to zero out only the single latency_statistic entry for the given type, but the memset size was computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire array starting from &lstat[type]. When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory. Fix by using sizeof(*lstat) to clear only the target entry. Fixes: 55ee5e67a59a ("iommu/vt-d: Add common code for dmar latency performa= nce monitors") Signed-off-by: Li RongQing --- drivers/iommu/intel/perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c index 02168f2..bec98dc 100644 --- a/drivers/iommu/intel/perf.c +++ b/drivers/iommu/intel/perf.c @@ -63,7 +63,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum= latency_type type) return; =20 spin_lock_irqsave(&latency_lock, flags); - memset(&lstat[type], 0, sizeof(*lstat) * DMAR_LATENCY_NUM); + memset(&lstat[type], 0, sizeof(*lstat)); spin_unlock_irqrestore(&latency_lock, flags); } =20 --=20 2.9.4