Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34;
From:   Julian Stecklina <julian.stecklina@cyberus-technology.de>
To:     Sean Christopherson <seanjc@google.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>
Cc:     Julian Stecklina <julian.stecklina@cyberus-technology.de>,
        kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/2] KVM: x86: Fix partially uninitialized integer in emulate_pop
Date:   Wed,  4 Oct 2023 15:38:26 +0200
Message-Id: <20231004133827.107-1-julian.stecklina@cyberus-technology.de>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+MJXLOkVpsMsydJpcrmJUwlHKEh2+kpt/0V5J71FPAkcCZq+fd6fnJ/4M2cT?=
 =?us-ascii?Q?fvQAvKipPS/AcsmI9PxUZyWu/llWV2xP9+ROCMUwcDNQB5WGwfmYaNhwjLWN?=
 =?us-ascii?Q?WKL9mp4t2euUiJt2cct9nBKES/651SnTWWp7NbU7oDFadyE7D+UWP/d3qUum?=
 =?us-ascii?Q?I4lw6j6bL6AF4EjRcsjImL+OJlIPQd39/QBbnbMZ/YjwaI0ndxi3Nw4S9o16?=
 =?us-ascii?Q?4O+DproI2fK2kQ8ZQVI/PXlxMbJmsXw0RITFX5PmgU0fNRjwSLhV3tSgIEfT?=
 =?us-ascii?Q?BQiAl9RzyWqUi1Yo2DjiOyQojGHG785RvOfppjY5Vt3FG7lYS54cVQyfet+p?=
 =?us-ascii?Q?IjPw3qogjeSNcgw6absYP+Rd9fEFEtC7fU2ktNBM/EYByiL4afVScnPHsxr2?=
 =?us-ascii?Q?VLpG3UcyFOT1na9dm62mqvaFiOEz7X/LH5NBPVGB7iiWBe/A5+7NoOXTFbD2?=
 =?us-ascii?Q?Zed2Ed6HQzdp4X3kARScUCMtf0fhyiAP9qMi8jbj/+af7PQbZINWBaauZk5R?=
 =?us-ascii?Q?edrldrmxmaCSXir0/4JKQ2/E9YjY92dqq1sgeoJOyKBDRgdkYQSwEvAxuxoT?=
 =?us-ascii?Q?t6VKJLnL1W7FS4j7xa9KEn+fmXVMWCzUqqf0cLQZUX+46MIC/LRhi69gktDB?=
 =?us-ascii?Q?BNz7e8yGrj3o1i6r0SZKBXMl1CzxP0QSle5z40irgf5TRUn8PbK1FKLldO/g?=
 =?us-ascii?Q?Ea9LHdHXIqd/Z+uZ8a3ZdulIgY3nxUCTh5V12WXZUBYQHiUecANxSkZjO0Ct?=
 =?us-ascii?Q?ZmLWrCqP70RDOM/G4oJLRlgAz5ENLQ0l7tCr1GnMtOEIOFQZWOvRL7zZe/pa?=
 =?us-ascii?Q?EffokPeS0JurJtPyUueguBxrnlgznz5ICs94S/uGCYUMK7mRvQAMU2kwQCzN?=
 =?us-ascii?Q?uye/CzCHcLbYwNcfVkVfwTNhLCSDl01/BXrw4SBZRAgduaYh6uxfgoLT/EYp?=
 =?us-ascii?Q?irYudPdadWYmAgmQxi0qkqwz2i80hWfv+M+u7se78f8W8ut6byUkUARVq12h?=
 =?us-ascii?Q?z14SlfZDn112Ah5CezxhNCmpHOYi+lRX/IL67HbLnd0cmZKaudWR1xxo0YD4?=
 =?us-ascii?Q?i+bT5PySrv2NJSocF6ZAiNVvmfnZXQcQ0mEvr5sDdIeSJ8bQQ1D5NAq4AgfS?=
 =?us-ascii?Q?n/SsZsT0A3bvPmuDVA1es6DW7XddOIzKTUsTb0r5POig1ikrzrOVVqC0BxwG?=
 =?us-ascii?Q?taZwzusCck8KwRLIi18p6ArC3FG1KDzN7OFZlRhzfHCEgVWxQ9isqWTWEKgB?=
 =?us-ascii?Q?sBtnQuPgQyQaYHRcwY5fRFpxqiY9m1P4Aci3VNn2aupmgiCntG/8Tjwc+5Fh?=
 =?us-ascii?Q?yIyPR7eyWjXYgs+flEM6cODn3AKbWJocbLI2tb+j1FRXLK+87dvrGozC9+iw?=
 =?us-ascii?Q?EcckCA9U9adlSjo/XVubTNsWqNxPQvZS/w2bV7yzgZVajg79zMt/0wChPQv+?=
 =?us-ascii?Q?r7zhq7IVGPiSSTo6GyRNkBcqBmG4FFuCXlj/+0PorqGwDwv17IfM7u23xWWK?=
 =?us-ascii?Q?NCLfcPR7Jj4nKxJ/4DS5ej1TeTItpY/LrpEePSCrZ7BC03wdY3LZXmUQVT15?=
 =?us-ascii?Q?30UV/Q/qduuYsP+ntPpcCMbGnDVhBZSHAjVL57Mc59cX61f80MDBU7C2zZC3?=
 =?us-ascii?Q?4jUe89aYnl5fTBDTt1e67VA=3D?=
X-OriginatorOrg: cyberus-technology.de
X-MS-Exchange-CrossTenant-Network-Message-Id: 09f957fb-172a-46df-2c10-08dbc4df3703
X-MS-Exchange-CrossTenant-AuthSource: FR3P281MB1567.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Oct 2023 13:38:38.4561
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f4e0f4e0-9d68-4bd6-a95b-0cba36dbac2e
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +gZOMyfxfFjd7OKvs94mDcucoYNZIhE2CrCC7wpKqlkaizkuGkl0ITffsl9i5RKwTcHVb61R9wKd8tkCbStsKsAHfEa9GMBG/zYPREHhGpddyzOk3LwcCbcgaws1xY49
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BE1P281MB1473
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Wed, 04 Oct 2023 06:38:48 -0700 (PDT)

Most code gives a pointer to an uninitialized unsigned long as dest in
emulate_pop. len is usually the word width of the guest.

If the guest runs in 16-bit or 32-bit modes, len will not cover the
whole unsigned long and we end up with uninitialized data in dest.

Looking through the callers of this function, the issue seems
harmless, but given that none of this is performance critical, there
should be no issue with just always initializing the whole value.

Fix this by explicitly requiring a unsigned long pointer and
initializing it with zero in all cases.

Signed-off-by: Julian Stecklina <julian.stecklina@cyberus-technology.de>
---
 arch/x86/kvm/emulate.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 2673cd5c46cb..fc4a365a309f 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1838,18 +1838,24 @@ static int em_push(struct x86_emulate_ctxt *ctxt)
 }
 
 static int emulate_pop(struct x86_emulate_ctxt *ctxt,
-		       void *dest, int len)
+		       unsigned long *dest, u8 op_bytes)
 {
 	int rc;
 	struct segmented_address addr;
 
+	/*
+	 * segmented_read below will only partially initialize dest when
+	 * we are not in 64-bit mode.
+	 */
+	*dest = 0;
+
 	addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt);
 	addr.seg = VCPU_SREG_SS;
-	rc = segmented_read(ctxt, addr, dest, len);
+	rc = segmented_read(ctxt, addr, dest, op_bytes);
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
 
-	rsp_increment(ctxt, len);
+	rsp_increment(ctxt, op_bytes);
 	return rc;
 }
 
@@ -1999,7 +2005,7 @@ static int em_popa(struct x86_emulate_ctxt *ctxt)
 {
 	int rc = X86EMUL_CONTINUE;
 	int reg = VCPU_REGS_RDI;
-	u32 val;
+	unsigned long val;
 
 	while (reg >= VCPU_REGS_RAX) {
 		if (reg == VCPU_REGS_RSP) {
-- 
2.40.1