diff mbox series

x86/MCE: avoid leaking stack data

Message ID a8f9db8d-6897-fdf6-11e0-2ba59f246175@suse.com (mailing list archive)
State New, archived
Headers show
Series x86/MCE: avoid leaking stack data | expand

Commit Message

Jan Beulich Jan. 8, 2020, 3:06 p.m. UTC 
While HYPERVISOR_mca is a privileged operation, we still shouldn't leak
stack contents (the tail of every array entry's mc_msrvalues[] of
XEN_MC_physcpuinfo output). Simply use a zeroing allocation here.

Take the occasion and also restrict the involved local variable's scope.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>

Comments

Andrew Cooper Jan. 8, 2020, 3:08 p.m. UTC | #1 
On 08/01/2020 15:06, Jan Beulich wrote:
> While HYPERVISOR_mca is a privileged operation, we still shouldn't leak
> stack contents (the tail of every array entry's mc_msrvalues[] of
> XEN_MC_physcpuinfo output). Simply use a zeroing allocation here.
>
> Take the occasion and also restrict the involved local variable's scope.
>
> Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
diff mbox series

Patch

--- a/xen/arch/x86/cpu/mcheck/mce.c
+++ b/xen/arch/x86/cpu/mcheck/mce.c
@@ -1352,7 +1352,6 @@  long do_mca(XEN_GUEST_HANDLE_PARAM(xen_m
     } mc_physcpuinfo;
     uint32_t flags, cmdflags;
     int nlcpu;
-    xen_mc_logical_cpu_t *log_cpus = NULL;
     mctelem_cookie_t mctc;
     mctelem_class_t which;
     unsigned int target;
@@ -1445,11 +1444,13 @@  long do_mca(XEN_GUEST_HANDLE_PARAM(xen_m
              ? !guest_handle_is_null(mc_physcpuinfo.nat->info)
              : !compat_handle_is_null(mc_physcpuinfo.cmp->info) )
         {
+            xen_mc_logical_cpu_t *log_cpus;
+
             if ( mc_physcpuinfo.nat->ncpus <= 0 )
                 return x86_mcerr("do_mca cpuinfo: ncpus <= 0",
                                  -EINVAL);
             nlcpu = min(nlcpu, (int)mc_physcpuinfo.nat->ncpus);
-            log_cpus = xmalloc_array(xen_mc_logical_cpu_t, nlcpu);
+            log_cpus = xzalloc_array(xen_mc_logical_cpu_t, nlcpu);
             if ( log_cpus == NULL )
                 return x86_mcerr("do_mca cpuinfo", -ENOMEM);
             on_each_cpu(do_mc_get_cpu_info, log_cpus, 1);