2023-10-12 23:19:56

by Mark Brown

Subject: [PATCH] KVM: selftests: Initialise dynamically allocated configuration names

When we dynamically generate a name for a configuration in get-reg-list
we use strcat() to append to a buffer allocated using malloc() but we
never initialise that buffer. Since malloc() offers no guarantees
regarding the contents of the memory it returns this can lead to us
corrupting, and likely overflowing, the buffer:

vregs: PASS
vregs+pmu: PASS
sve: PASS
sve+pmu: PASS
vregs+pauth_address+pauth_generic: PASS
X�vr+gspauth_addre+spauth_generi+pmu: PASS

Initialise the buffer to an empty string to avoid this.

Fixes: 17da79e009c37 ("KVM: arm64: selftests: Split get-reg-list test code")
Signed-off-by: Mark Brown <[email protected]>
---
tools/testing/selftests/kvm/get-reg-list.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/kvm/get-reg-list.c b/tools/testing/selftests/kvm/get-reg-list.c
index be7bf5224434..dd62a6976c0d 100644
--- a/tools/testing/selftests/kvm/get-reg-list.c
+++ b/tools/testing/selftests/kvm/get-reg-list.c
@@ -67,6 +67,7 @@ static const char *config_name(struct vcpu_reg_list *c)

c->name = malloc(len);

+ c->name[0] = '\0';
len = 0;
for_each_sublist(c, s) {
if (!strcmp(s->name, "base"))

---
base-commit: 6465e260f48790807eef06b583b38ca9789b6072
change-id: 20231012-kvm-get-reg-list-str-init-76c8ed4e19d6

Best regards,
--
Mark Brown <[email protected]>

2023-10-13 06:30:51

by Andrew Jones

Subject: Re: [PATCH] KVM: selftests: Initialise dynamically allocated configuration names

On Fri, Oct 13, 2023 at 12:19:30AM +0100, Mark Brown wrote:
> When we dynamically generate a name for a configuration in get-reg-list
> we use strcat() to append to a buffer allocated using malloc() but we
> never initialise that buffer. Since malloc() offers no guarantees
> regarding the contents of the memory it returns this can lead to us
> corrupting, and likely overflowing, the buffer:
>
> vregs: PASS
> vregs+pmu: PASS
> sve: PASS
> sve+pmu: PASS
> vregs+pauth_address+pauth_generic: PASS
> X�vr+gspauth_addre+spauth_generi+pmu: PASS
>
> Initialise the buffer to an empty string to avoid this.
>
> Fixes: 17da79e009c37 ("KVM: arm64: selftests: Split get-reg-list test code")

Doh, this is an embarrassing bug. But the patch above just moves the buggy
code. I'm still guilty for the bug, but the fixes tag should be

Fixes: 2f9ace5d4557 ("KVM: arm64: selftests: get-reg-list: Introduce vcpu configs")

> Signed-off-by: Mark Brown <[email protected]>
> ---
> tools/testing/selftests/kvm/get-reg-list.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/tools/testing/selftests/kvm/get-reg-list.c b/tools/testing/selftests/kvm/get-reg-list.c
> index be7bf5224434..dd62a6976c0d 100644
> --- a/tools/testing/selftests/kvm/get-reg-list.c
> +++ b/tools/testing/selftests/kvm/get-reg-list.c
> @@ -67,6 +67,7 @@ static const char *config_name(struct vcpu_reg_list *c)
>
> c->name = malloc(len);
>
> + c->name[0] = '\0';
> len = 0;
> for_each_sublist(c, s) {
> if (!strcmp(s->name, "base"))
>
> ---
> base-commit: 6465e260f48790807eef06b583b38ca9789b6072
> change-id: 20231012-kvm-get-reg-list-str-init-76c8ed4e19d6
>

Other than the tag,

Reviewed-by: Andrew Jones <[email protected]>

Thanks,
drew