diff options
author | Mateusz Jurczyk <mjurczyk@google.com> | 2017-05-24 15:55:00 +0200 |
---|---|---|
committer | Thomas Gleixner <tglx@linutronix.de> | 2017-05-24 16:18:12 +0200 |
commit | fc152d22d6e9fac95a9a990e6c29510bdf1b9425 (patch) | |
tree | c784fbbc87c38aa14979ec3ff7d4a70741761ffa /arch/x86/kernel/setup.c | |
parent | cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 (diff) | |
download | lwn-fc152d22d6e9fac95a9a990e6c29510bdf1b9425.tar.gz lwn-fc152d22d6e9fac95a9a990e6c29510bdf1b9425.zip |
x86/alternatives: Prevent uninitialized stack byte read in apply_alternatives()
In the current form of the code, if a->replacementlen is 0, the reference
to *insnbuf for comparison touches potentially garbage memory. While it
doesn't affect the execution flow due to the subsequent a->replacementlen
comparison, it is (rightly) detected as use of uninitialized memory by a
runtime instrumentation currently under my development, and could be
detected as such by other tools in the future, too (e.g. KMSAN).
Fix the "false-positive" by reordering the conditions to first check the
replacement instruction length before referencing specific opcode bytes.
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@kernel.org>
Link: http://lkml.kernel.org/r/20170524135500.27223-1-mjurczyk@google.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'arch/x86/kernel/setup.c')
0 files changed, 0 insertions, 0 deletions