Messages in this thread Patch in this message | | | Date | Wed, 19 Oct 2022 19:58:15 +0000 | Subject | [PATCH v2] virt/coco/sev-guest: Remove err in handle_guest_request | From | Dionna Glaze <> |
| |
The err variable may not be set in the call to snp_issue_guest_request, yet it is unconditionally written back to fw_err if fw_err is non-null. This is undefined behavior, and currently returns uninitialized kernel stack memory to user space.
The fw_err argument is better to just pass through to snp_issue_guest_request, so we do that.
Cc: Tom Lendacky <Thomas.Lendacky@amd.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Joerg Roedel <jroedel@suse.de> Cc: Peter Gonda <pgonda@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Dionna Glaze <dionnaglaze@google.com> --- drivers/virt/coco/sev-guest/sev-guest.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c index f422f9c58ba7..00708b4491e0 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -305,7 +305,6 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in u8 type, void *req_buf, size_t req_sz, void *resp_buf, u32 resp_sz, __u64 *fw_err) { - unsigned long err; u64 seqno; int rc; @@ -322,9 +321,7 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in return rc; /* Call firmware to process the request */ - rc = snp_issue_guest_request(exit_code, &snp_dev->input, &err); - if (fw_err) - *fw_err = err; + rc = snp_issue_guest_request(exit_code, &snp_dev->input, fw_err); if (rc) return rc; -- 2.38.0.413.g74048e4d9e-goog
| |