lkml.org 
[lkml]   [2022]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 0216/1126] selftests/sgx: Fix NULL-pointer-dereference upon early test failure
    Date
    From: Reinette Chatre <reinette.chatre@intel.com>

    [ Upstream commit 2d03861e0d1d1ee81efc59338101cdd86a7474f6 ]

    == Background ==

    The SGX selftests track parts of the enclave binaries in an array:
    encl->segment_tbl[]. That array is dynamically allocated early
    (but not first) in the test's lifetime. The array is referenced
    at the end of the test in encl_delete().

    == Problem ==

    encl->segment_tbl[] can be NULL if the test fails before its
    allocation. That leads to a NULL-pointer-dereference in encl_delete().
    This is triggered during early failures of the selftest like if the
    enclave binary ("test_encl.elf") is deleted.

    == Solution ==

    Ensure encl->segment_tbl[] is valid before attempting to access
    its members. The offset with which it is accessed, encl->nr_segments,
    is initialized before encl->segment_tbl[] and thus considered valid
    to use after the encl->segment_tbl[] check succeeds.

    Fixes: 3200505d4de6 ("selftests/sgx: Create a heap for the test enclave")
    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Acked-by: Shuah Khan <skhan@linuxfoundation.org>
    Link: https://lkml.kernel.org/r/90a31dfd640ea756fa324712e7cbab4a90fa7518.1644355600.git.reinette.chatre@intel.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    tools/testing/selftests/sgx/load.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    diff --git a/tools/testing/selftests/sgx/load.c b/tools/testing/selftests/sgx/load.c
    index 9d4322c946e2..006b464c8fc9 100644
    --- a/tools/testing/selftests/sgx/load.c
    +++ b/tools/testing/selftests/sgx/load.c
    @@ -21,7 +21,7 @@

    void encl_delete(struct encl *encl)
    {
    - struct encl_segment *heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
    + struct encl_segment *heap_seg;

    if (encl->encl_base)
    munmap((void *)encl->encl_base, encl->encl_size);
    @@ -32,10 +32,11 @@ void encl_delete(struct encl *encl)
    if (encl->fd)
    close(encl->fd);

    - munmap(heap_seg->src, heap_seg->size);
    -
    - if (encl->segment_tbl)
    + if (encl->segment_tbl) {
    + heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
    + munmap(heap_seg->src, heap_seg->size);
    free(encl->segment_tbl);
    + }

    memset(encl, 0, sizeof(*encl));
    }
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-05 10:09    [W:5.511 / U:1.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site