Commit 2d03861e authored by Reinette Chatre's avatar Reinette Chatre Committed by Dave Hansen
Browse files

selftests/sgx: Fix NULL-pointer-dereference upon early test failure 



== Background ==

The SGX selftests track parts of the enclave binaries in an array:
encl->segment_tbl[]. That array is dynamically allocated early
(but not first) in the test's lifetime. The array is referenced
at the end of the test in encl_delete().

== Problem ==

encl->segment_tbl[] can be NULL if the test fails before its
allocation. That leads to a NULL-pointer-dereference in encl_delete().
This is triggered during early failures of the selftest like if the
enclave binary ("test_encl.elf") is deleted.

== Solution ==

Ensure encl->segment_tbl[] is valid before attempting to access
its members. The offset with which it is accessed, encl->nr_segments,
is initialized before encl->segment_tbl[] and thus considered valid
to use after the encl->segment_tbl[] check succeeds.

Fixes: 3200505d ("selftests/sgx: Create a heap for the test enclave")
Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Acked-by: default avatarShuah Khan <skhan@linuxfoundation.org>
Link: https://lkml.kernel.org/r/90a31dfd640ea756fa324712e7cbab4a90fa7518.1644355600.git.reinette.chatre@intel.com
parent dfd42fac

tools/testing/selftests/sgx/load.c

+5 −4
Original line number Diff line number Diff line
@@ -21,7 +21,7 @@ 


void encl_delete(struct encl *encl)

{

	struct encl_segment *heap_seg = &encl->segment_tbl[encl->nr_segments - 1];

	struct encl_segment *heap_seg;



	if (encl->encl_base)

		munmap((void *)encl->encl_base, encl->encl_size);
@@ -32,10 +32,11 @@ void encl_delete(struct encl *encl) 
	if (encl->fd)

		close(encl->fd);



	if (encl->segment_tbl) {

		heap_seg = &encl->segment_tbl[encl->nr_segments - 1];

		munmap(heap_seg->src, heap_seg->size);



	if (encl->segment_tbl)

		free(encl->segment_tbl);

	}



	memset(encl, 0, sizeof(*encl));

}