vfio/pci: Fix information leak in vfio_rom_read()
vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com> Reviewed-by: Mario Casquero <mcasquer@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Cédric Le Goater committed
Jun 2, 2026 at 09:44 UTC
402fd5a7565972313e0c0ffa2d332fe6e8bed150
1 file changed
+1
-1
hw/vfio/pci.c
+1
-1
@@ -1143,7 +1143,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
1143
uint16_t word;
1144
uint32_t dword;
1145
uint64_t qword;
1146
- } val;
1146
+ } val = { .qword = ~0ULL };
1147
uint64_t data = 0;
1148
1149
/* Load the ROM lazily when the guest tries to read it */