target/i386/mshv: zero-init msr hvcall args

[PATCH] target/i386/mshv: zero-init msr hvcall args

Posted by Magnus Kulke 3 weeks, 3 days ago

In the current code we leave the argument arrays for the get/set hvcall
unitialized, setting only individual fields. some fields will be
populated during the hvcall, but in any case the arg arrays will contain
unitialized data (e.g. in reserved fields), to which static analysis
objects to.

Fixes: c38eb12c85
Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
---
 target/i386/mshv/msr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/mshv/msr.c b/target/i386/mshv/msr.c
index 8c220a9942..a35415ed9d 100644
--- a/target/i386/mshv/msr.c
+++ b/target/i386/mshv/msr.c
@@ -326,7 +326,7 @@ int mshv_get_msrs(CPUState *cpu)
 {
     int ret = 0;
     size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
-    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
+    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };
     size_t i, j;
     uint32_t name;
 
@@ -386,7 +386,7 @@ static void load_from_env(const CPUState *cpu, struct hv_register_assoc *assocs,
 int mshv_set_msrs(const CPUState *cpu)
 {
     size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
-    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
+    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };
     int ret;
     size_t i, j;
 
-- 
2.34.1

Re: [PATCH] target/i386/mshv: zero-init msr hvcall args

Posted by Doru Blânzeanu 3 weeks, 2 days ago

On Wed, Jul 01, 2026 at 03:42:14PM +0200, Magnus Kulke wrote:
> In the current code we leave the argument arrays for the get/set hvcall
> unitialized, setting only individual fields. some fields will be
> populated during the hvcall, but in any case the arg arrays will contain
> unitialized data (e.g. in reserved fields), to which static analysis
> objects to.
> 
> Fixes: c38eb12c85
> Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
> ---
>  target/i386/mshv/msr.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/target/i386/mshv/msr.c b/target/i386/mshv/msr.c
> index 8c220a9942..a35415ed9d 100644
> --- a/target/i386/mshv/msr.c
> +++ b/target/i386/mshv/msr.c
> @@ -326,7 +326,7 @@ int mshv_get_msrs(CPUState *cpu)
>  {
>      int ret = 0;
>      size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
> -    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
> +    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };
>      size_t i, j;
>      uint32_t name;
>  
> @@ -386,7 +386,7 @@ static void load_from_env(const CPUState *cpu, struct hv_register_assoc *assocs,
>  int mshv_set_msrs(const CPUState *cpu)
>  {
>      size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
> -    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
> +    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };
>      int ret;
>      size_t i, j;
>  
> -- 
> 2.34.1

Reviewed-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com>

Re: [PATCH] target/i386/mshv: zero-init msr hvcall args

Posted by Philippe Mathieu-Daudé 3 weeks, 3 days ago

On 1/7/26 15:42, Magnus Kulke wrote:
> In the current code we leave the argument arrays for the get/set hvcall
> unitialized, setting only individual fields. some fields will be
> populated during the hvcall, but in any case the arg arrays will contain
> unitialized data (e.g. in reserved fields), to which static analysis
> objects to.
> 
> Fixes: c38eb12c85
> Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
> ---
>   target/i386/mshv/msr.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/target/i386/mshv/msr.c b/target/i386/mshv/msr.c
> index 8c220a9942..a35415ed9d 100644
> --- a/target/i386/mshv/msr.c
> +++ b/target/i386/mshv/msr.c
> @@ -326,7 +326,7 @@ int mshv_get_msrs(CPUState *cpu)
>   {
>       int ret = 0;
>       size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
> -    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
> +    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };

Matter of style, '{ }' is clearer. Otherwise this can be read as
"uint32_t name is explicitly set to 0, hv_register_value value is
implicitly zeroed". Anyway nitpicking, so:

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

>       size_t i, j;
>       uint32_t name;
>   
> @@ -386,7 +386,7 @@ static void load_from_env(const CPUState *cpu, struct hv_register_assoc *assocs,
>   int mshv_set_msrs(const CPUState *cpu)
>   {
>       size_t n_assocs = MSHV_MSR_TOTAL_COUNT;
> -    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT];
> +    struct hv_register_assoc assocs[MSHV_MSR_TOTAL_COUNT] = { 0 };
>       int ret;
>       size_t i, j;
>