From nobody Sun Nov 16 20:49:01 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1601970839; cv=none; d=zohomail.com; s=zohoarc; b=Sa0Nvx90TLTfR3w/DP4RGst8EjmSWrlVqlP9g804slULySbAsO/s6O7jfJiNcpOimYqJuoJZoF4KabnQqfDJsrzvcOZI0+rFLJaPXTmXtgY3HkiCIse9eaPj56t7ggU8wLoPG0sRjYjXK8XL4Fj4WndxVbLqDpR6vdxMZ2UgFrM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1601970839; h=Content-Transfer-Encoding:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=oFWLyt6kWARZltFpBlg1mJTxorWVjFMh4mO9BoqNxBs=; b=JoL91M2q3HLL7/cASwxr1nJQ7im5TCRqvwaMi0dKhyPb/ixl+Dw1gU84KgiTC5aCHCH41O6UhxgKydOC7P62FS0NNzgzxT2Ros6RScwAJWxyC/fhBDgggJVpM+96vhIRoAeV6nxWuolSf1u+kOgoMKXlQh0zjTtFMDd+D9o1cJI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1601970839696305.020258645823; Tue, 6 Oct 2020 00:53:59 -0700 (PDT) Received: from localhost ([::1]:54308 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kPhnK-0000Cw-Bd for importer@patchew.org; Tue, 06 Oct 2020 03:53:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42916) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kPhi3-0002gt-JK for qemu-devel@nongnu.org; Tue, 06 Oct 2020 03:48:31 -0400 Received: from mail-wr1-x443.google.com ([2a00:1450:4864:20::443]:39237) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kPhi2-0003lD-1t for qemu-devel@nongnu.org; Tue, 06 Oct 2020 03:48:31 -0400 Received: by mail-wr1-x443.google.com with SMTP id k10so12273228wru.6 for ; Tue, 06 Oct 2020 00:48:29 -0700 (PDT) Received: from localhost.localdomain ([2001:b07:6468:f312:5aca:cd0b:c4a1:9c2e]) by smtp.gmail.com with ESMTPSA id a17sm3195272wra.29.2020.10.06.00.48.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2020 00:48:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=oFWLyt6kWARZltFpBlg1mJTxorWVjFMh4mO9BoqNxBs=; b=PYugD1hKhEzYHvUXlbxLS8m9aNtp/jmcAXFLx8LlWwyk7dfWwI+zpkQ19MU/L0tvEX 4rPvHeHVSil6JUWsCLQ4f14xcJmdyPzGamGC30bmSM4JYYqJXoPD0tavL8EwpSB9Kyjf /pMgW6ryoRk2ru1CfDAztF207MDPlBgEtXpmbK01IS1bDY7Z5ELycy7hG71BXU4SaKC7 Ow0H9LaUwo6uVilgYMYuDcHi/8XD4EWwk+Uwwz2lNfIxY4zhjvrq80H8qqlg7uWoXaxZ BHRRAKwM61O6CB+AVbbwf2oar+TfviblgqBOMq7XhxpR8seyyBu8p+DMI51l6kT+jdCh YNoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:subject:date:message-id :mime-version:content-transfer-encoding; bh=oFWLyt6kWARZltFpBlg1mJTxorWVjFMh4mO9BoqNxBs=; b=euAmZJ8dBNvKYHf0NO3Ceoj4fkeV/UDnw6YQgV++qKGaLbhY/Zv2BDrDV8H4iN/vn3 W2jCDrdoYOuCpMPMtERIXd/FEqfqO8AM2/9YGz78gAAkmzF64Vag+PbAQTHqVP9FjgDW +wSc1k469K9BHFm7XKJmpeelj0QmulOGPkHfL5L4kbxvhZ3OohzERc1GfSBYauWeuv4M WMmNR5KCPCURrtBOskndXn9yS5cu9k536MKj6tRdySZR/yET+n4stSEDNGCl1PFEVwbU k/urWdSPDaXu/O2qQwqi2v2zAOUZslJ0UqN1KPj5PBzBSKkTzaC2pQE37t5QehAcNd8/ z3Pg== X-Gm-Message-State: AOAM531LkPTKCkHrdz/0HaZ+vZtbPhNZtYrFiO0NYzjf1FO0bEEkYl75 i7lNohgLCKxTFGOy2o8cRBcBb1YpZTY= X-Google-Smtp-Source: ABdhPJyMrfrOURnL5Hk8+Mh1yxwNkL+XN30U1X/f+55ZiyucPIZf20apkJ4GDKnkyZfyJ7Dhhbr43g== X-Received: by 2002:adf:90a2:: with SMTP id i31mr3698157wri.276.1601970508005; Tue, 06 Oct 2020 00:48:28 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Subject: [PATCH] target/i386: avoid theoretical leak on MCE injection Date: Tue, 6 Oct 2020 09:48:29 +0200 Message-Id: <20201006074829.488968-1-pbonzini@redhat.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::443; envelope-from=paolo.bonzini@gmail.com; helo=mail-wr1-x443.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -14 X-Spam_score: -1.5 X-Spam_bar: - X-Spam_report: (-1.5 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.248, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" g_strdup_printf is used twice to write to the same variable, which can theoretically cause a leak. In practice, it is extremely unlikely that a guest is seeing a recursive MCE and has disabled CR4.MCE between the first and the second error, but we can fix it and we can also make a slight improvement on the logic: CR4.MCE=3D0 causes a triple fault even for a non-recursive machine check, so let's place its test first. Signed-off-by: Paolo Bonzini Reviewed-by: Peter Maydell --- target/i386/helper.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/target/i386/helper.c b/target/i386/helper.c index 32fa21a7bb..f64379367d 100644 --- a/target/i386/helper.c +++ b/target/i386/helper.c @@ -908,16 +908,14 @@ static void do_inject_x86_mce(CPUState *cs, run_on_cp= u_data data) return; } =20 - if (recursive) { - need_reset =3D true; - msg =3D g_strdup_printf("CPU %d: Previous MCE still in progres= s, " - "raising triple fault", cs->cpu_index); - } - if (!(cenv->cr[4] & CR4_MCE_MASK)) { need_reset =3D true; msg =3D g_strdup_printf("CPU %d: MCE capability is not enabled= , " "raising triple fault", cs->cpu_index); + } else if (recursive) { + need_reset =3D true; + msg =3D g_strdup_printf("CPU %d: Previous MCE still in progres= s, " + "raising triple fault", cs->cpu_index); } =20 if (need_reset) { --=20 2.26.2