Skip to content

Commit f15e006

Browse files
committed
9p/xen: do not memcpy header into req->rc
while 'h' is packed and can be assumed to match the request payload, req->rc is a struct p9_fcall which is not packed and that memcpy could be wrong. Fix this by copying each fields individually instead. Reported-by: Christian Schoenebeck <linux_oss@crudebyte.com> Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com> Suggested-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Link: https://lkml.kernel.org/r/alpine.DEB.2.22.394.2211211454540.1049131@ubuntu-linux-20-04-desktop Link: https://lkml.kernel.org/r/20221122001025.119121-1-asmadeus@codewreck.org Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
1 parent 26273ad commit f15e006

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

net/9p/trans_xen.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,9 @@ static void p9_xen_response(struct work_struct *work)
216216
goto recv_error;
217217
}
218218

219-
memcpy(&req->rc, &h, sizeof(h));
219+
req->rc.size = h.size;
220+
req->rc.id = h.id;
221+
req->rc.tag = h.tag;
220222
req->rc.offset = 0;
221223

222224
masked_cons = xen_9pfs_mask(cons, XEN_9PFS_RING_SIZE(ring));

0 commit comments

Comments
 (0)