diff mbox series

x86/mm: Fix use of uninitialized buffer in sme_enable()

Message ID 20230202182538.29352-1-n.zhandarovich@fintech.ru
State New
Headers
Series x86/mm: Fix use of uninitialized buffer in sme_enable() |

Commit Message

Nikita Zhandarovich Feb. 2, 2023, 6:25 p.m. UTC 
  cmdline_find_option() may fail before doing any initialization of
buffer array. This may lead to unpredictable results when the same
buffer is used later in calls to strncmp() function.
Fix the issue by initializing the buffer to an empty string.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
 arch/x86/mm/mem_encrypt_identity.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Borislav Petkov Feb. 17, 2023, 9:47 p.m. UTC | #1 
On Thu, Feb 02, 2023 at 10:25:38AM -0800, Nikita Zhandarovich wrote:
> cmdline_find_option() may fail before doing any initialization of
> buffer array. This may lead to unpredictable results when the same
> buffer is used later in calls to strncmp() function.
> Fix the issue by initializing the buffer to an empty string.

I'd prefer if you test cmdline_find_option()'s return value instead and
return early if -1.

> Found by Linux Verification Center (linuxtesting.org) with SVACE.

SVACE is?

> Fixes: 1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit")

The proper Fixes commit should be:

aca20d546214 ("x86/mm: Add support to make use of Secure Memory Encryption")

Thx.
diff mbox series

Patch

diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 88cccd65029d..6b84243bfd54 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -509,7 +509,7 @@  void __init sme_enable(struct boot_params *bp)
 	unsigned long feature_mask;
 	bool active_by_default;
 	unsigned long me_mask;
-	char buffer[16];
+	char buffer[16] = "";
 	bool snp;
 	u64 msr;