Re: [PATCH] iommu/intel: fix out-of-bounds memset in dmar_latency_disable()

[Will Deacon]

On Tue, 21 Jul 2026 17:34:10 +0800, lirongqing wrote:
> dmar_latency_disable() intends to zero out only the single
> latency_statistic entry for the given type, but the memset size was
> computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire
> array starting from &lstat[type].
> 
> When type > 0, this writes beyond the end of the allocated array,
> corrupting adjacent memory.
> 
> [...]

Applied to iommu (fixes), thanks!

[1/1] iommu/intel: fix out-of-bounds memset in dmar_latency_disable()
      https://git.kernel.org/iommu/c/754f8efe45f8

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev