2023-02-02 18:26:02

by Nikita Zhandarovich

Subject: [PATCH] x86/mm: Fix use of uninitialized buffer in sme_enable()

cmdline_find_option() may fail before doing any initialization of
buffer array. This may lead to unpredictable results when the same
buffer is used later in calls to strncmp() function.
Fix the issue by initializing the buffer to an empty string.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit")
Signed-off-by: Nikita Zhandarovich <[email protected]>
---
arch/x86/mm/mem_encrypt_identity.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 88cccd65029d..6b84243bfd54 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -509,7 +509,7 @@ void __init sme_enable(struct boot_params *bp)
unsigned long feature_mask;
bool active_by_default;
unsigned long me_mask;
- char buffer[16];
+ char buffer[16] = "";
bool snp;
u64 msr;

--
2.25.1

2023-02-17 21:47:34

by Borislav Petkov

Subject: Re: [PATCH] x86/mm: Fix use of uninitialized buffer in sme_enable()

On Thu, Feb 02, 2023 at 10:25:38AM -0800, Nikita Zhandarovich wrote:
> cmdline_find_option() may fail before doing any initialization of
> buffer array. This may lead to unpredictable results when the same
> buffer is used later in calls to strncmp() function.
> Fix the issue by initializing the buffer to an empty string.

I'd prefer if you test cmdline_find_option()'s return value instead and
return early if -1.

> Found by Linux Verification Center (linuxtesting.org) with SVACE.

SVACE is?

> Fixes: 1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit")

The proper Fixes commit should be:

aca20d546214 ("x86/mm: Add support to make use of Secure Memory Encryption")

Thx.

--
Regards/Gruss,
Boris.

https://people.kernel.org/tglx/notes-about-netiquette