Re: [Xen-devel] [PATCH v1 01/13] xen/arm: domain: Zero the per-vCPU cpu_info

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Tue, 5 Jun 2018, Julien Grall wrote:
> A stack is allocated per vCPU to be used by Xen. The allocation is done
> with alloc_xenheap_pages that does not zero the memory returned. However
> the top of the stack is containing information that will be used to
> store the initial state of the vCPU (see struct cpu_info). Some of the
> fields may not be initialized and will lead to use/leak bits of previous
> memory in some cases on the first run of vCPU (AFAICT this only happen on
> vCPU0 for Dom0).
> 
> This is part of XSA-263.
> 
> Signed-off-by: Julien Grall <julien.grall@xxxxxxx>

Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>


> ---
>     Changes in v2:
>         - Zero only cpu_info
> ---
>  xen/arch/arm/domain.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
> index ec0f042bf7..5a2a9a6b83 100644
> --- a/xen/arch/arm/domain.c
> +++ b/xen/arch/arm/domain.c
> @@ -550,6 +550,7 @@ int vcpu_initialise(struct vcpu *v)
>      v->arch.cpu_info = (struct cpu_info *)(v->arch.stack
>                                             + STACK_SIZE
>                                             - sizeof(struct cpu_info));
> +    memset(v->arch.cpu_info, 0, sizeof(*v->arch.cpu_info));
>  
>      memset(&v->arch.saved_context, 0, sizeof(v->arch.saved_context));
>      v->arch.saved_context.sp = (register_t)v->arch.cpu_info;
> -- 
> 2.11.0
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel