linux-kernel - [tip: x86/sgx] selftests/sgx: Fix NULL-pointer-dereference upon early test failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <164461681510.16921.7342982385624280943.tip-bot2@tip-bot2>
Date:   Fri, 11 Feb 2022 22:00:15 -0000
From:   "tip-bot2 for Reinette Chatre" <tip-bot2@...utronix.de>
To:     linux-tip-commits@...r.kernel.org
Cc:     Reinette Chatre <reinette.chatre@...el.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Shuah Khan <skhan@...uxfoundation.org>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: [tip: x86/sgx] selftests/sgx: Fix NULL-pointer-dereference upon early
 test failure

The following commit has been merged into the x86/sgx branch of tip:

Commit-ID:     2d03861e0d1d1ee81efc59338101cdd86a7474f6
Gitweb:        https://git.kernel.org/tip/2d03861e0d1d1ee81efc59338101cdd86a7474f6
Author:        Reinette Chatre <reinette.chatre@...el.com>
AuthorDate:    Tue, 08 Feb 2022 13:48:39 -08:00
Committer:     Dave Hansen <dave.hansen@...ux.intel.com>
CommitterDate: Fri, 11 Feb 2022 13:52:47 -08:00

selftests/sgx: Fix NULL-pointer-dereference upon early test failure

== Background ==

The SGX selftests track parts of the enclave binaries in an array:
encl->segment_tbl[]. That array is dynamically allocated early
(but not first) in the test's lifetime. The array is referenced
at the end of the test in encl_delete().

== Problem ==

encl->segment_tbl[] can be NULL if the test fails before its
allocation. That leads to a NULL-pointer-dereference in encl_delete().
This is triggered during early failures of the selftest like if the
enclave binary ("test_encl.elf") is deleted.

== Solution ==

Ensure encl->segment_tbl[] is valid before attempting to access
its members. The offset with which it is accessed, encl->nr_segments,
is initialized before encl->segment_tbl[] and thus considered valid
to use after the encl->segment_tbl[] check succeeds.

Fixes: 3200505d4de6 ("selftests/sgx: Create a heap for the test enclave")
Signed-off-by: Reinette Chatre <reinette.chatre@...el.com>
Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Acked-by: Shuah Khan <skhan@...uxfoundation.org>
Link: https://lkml.kernel.org/r/90a31dfd640ea756fa324712e7cbab4a90fa7518.1644355600.git.reinette.chatre@intel.com
---
 tools/testing/selftests/sgx/load.c |  9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/sgx/load.c b/tools/testing/selftests/sgx/load.c
index 9d4322c..006b464 100644
--- a/tools/testing/selftests/sgx/load.c
+++ b/tools/testing/selftests/sgx/load.c
@@ -21,7 +21,7 @@
 
 void encl_delete(struct encl *encl)
 {
-	struct encl_segment *heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
+	struct encl_segment *heap_seg;
 
 	if (encl->encl_base)
 		munmap((void *)encl->encl_base, encl->encl_size);
@@ -32,10 +32,11 @@ void encl_delete(struct encl *encl)
 	if (encl->fd)
 		close(encl->fd);
 
-	munmap(heap_seg->src, heap_seg->size);
-
-	if (encl->segment_tbl)
+	if (encl->segment_tbl) {
+		heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
+		munmap(heap_seg->src, heap_seg->size);
 		free(encl->segment_tbl);
+	}
 
 	memset(encl, 0, sizeof(*encl));
 }