Re: [Xen-devel] [PATCH 3/4] AMD/microcode: Avoid use-after-free for the microcode buffer

[Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>]

On 12/27/2013 10:36 AM, Andrew Cooper wrote:
> On 27/12/2013 15:30, Boris Ostrovsky wrote:
> > On 12/27/2013 09:57 AM, Andrew Cooper wrote:
> > > It is possible to free the mc_old buffer and the store it for use on
> > > in the
> > I think you don't need *the* store here. And no *on*.
> Oops - I refactored my sentence half way through, and missed that on a
> reread.
>
> > > case of resume.
> > >
> > > This keeps the old semantics of being able to return an error even
> > > after a
> > > successful microcode application.
> > >
> > > Coverity-ID 1146953
> > > Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> > > CC: Keir Fraser <keir@xxxxxxx>
> > > CC: Jan Beulich <JBeulich@xxxxxxxx>
> > > CC: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
> > > CC: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
> > > ---
> > >    xen/arch/x86/microcode_amd.c |   17 +++++++++--------
> > >    1 file changed, 9 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/xen/arch/x86/microcode_amd.c b/xen/arch/x86/microcode_amd.c
> > > index a3ceef8..8ea4e63 100644
> > > --- a/xen/arch/x86/microcode_amd.c
> > > +++ b/xen/arch/x86/microcode_amd.c
> > > @@ -275,7 +275,7 @@ static int cpu_request_microcode(int cpu, const
> > > void *buf, size_t bufsize)
> > >        struct microcode_amd *mc_amd, *mc_old;
> > >        size_t offset = bufsize;
> > >        size_t last_offset, applied_offset = 0;
> > > -    int error = 0;
> > > +    int error = 0, save_error = 1;
> > >        struct ucode_cpu_info *uci = &per_cpu(ucode_cpu_info, cpu);
> > >          /* We should bind the task to the CPU */
> > > @@ -338,19 +338,20 @@ static int cpu_request_microcode(int cpu, const
> > > void *buf, size_t bufsize)
> > >         */
> > >        if ( applied_offset )
> > >        {
> > > -        int ret = get_ucode_from_buffer_amd(mc_amd, buf, bufsize,
> > > -                                            &applied_offset);
> > > -        if ( ret == 0 )
> > > -            xfree(mc_old);
> > > -        else
> > > -            error = ret;
> > > +        save_error = get_ucode_from_buffer_amd(
> > > +            mc_amd, buf, bufsize, &applied_offset);
> > > +
> > > +        if ( save_error )
> > > +            error = save_error
> > >        }
> > >    -    if ( !applied_offset || error )
> > > +    if ( save_error )
> > >        {
> > >            xfree(mc_amd);
> > >            uci->mc.mc_amd = mc_old;
> > >        }
> > > +    else
> > > +        xfree(mc_old);
> > Won't this free mc_old (which is where previous microcode lived) even
> > if the new buffer didn't have any valid microcode (i.e. applied_offset
> > is zero)?
> >
> > -boris
> save_error starts off as 1, and only gets set to 0 on a successful
> get_ucode_from_buffer_amd(), so we will only free mc_old in the case
> that we have valid microcde in mc_amd.  All other cases free mc_amd and
> revert to using mc_old.
>
> ~Andrew

Ah, I missed that save_error is initialized to 1.

Acked-by: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>


> > >        out:
> > >        svm_host_osvw_init();

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel