From: Jan Beulich Date: Thu, 9 Jan 2020 10:08:29 +0000 (+0100) Subject: x86/MCE: avoid leaking stack data X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~911 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/%22bookmarks:/?a=commitdiff_plain;h=9fdad93087e04cb3a155c62344eb88149e1cfc4a;p=xen.git x86/MCE: avoid leaking stack data While HYPERVISOR_mca is a privileged operation, we still shouldn't leak stack contents (the tail of every array entry's mc_msrvalues[] of XEN_MC_physcpuinfo output). Simply use a zeroing allocation here. Take the occasion and also restrict the involved local variable's scope. Reported-by: Ilja Van Sprundel Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index c8cecc4976..29f3f9c5e3 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -1352,7 +1352,6 @@ long do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc) } mc_physcpuinfo; uint32_t flags, cmdflags; int nlcpu; - xen_mc_logical_cpu_t *log_cpus = NULL; mctelem_cookie_t mctc; mctelem_class_t which; unsigned int target; @@ -1445,11 +1444,13 @@ long do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc) ? !guest_handle_is_null(mc_physcpuinfo.nat->info) : !compat_handle_is_null(mc_physcpuinfo.cmp->info) ) { + xen_mc_logical_cpu_t *log_cpus; + if ( mc_physcpuinfo.nat->ncpus <= 0 ) return x86_mcerr("do_mca cpuinfo: ncpus <= 0", -EINVAL); nlcpu = min(nlcpu, (int)mc_physcpuinfo.nat->ncpus); - log_cpus = xmalloc_array(xen_mc_logical_cpu_t, nlcpu); + log_cpus = xzalloc_array(xen_mc_logical_cpu_t, nlcpu); if ( log_cpus == NULL ) return x86_mcerr("do_mca cpuinfo", -ENOMEM); on_each_cpu(do_mc_get_cpu_info, log_cpus, 1);