Skip to content

Commit 2d03861

Browse files
rchatrehansendc
authored andcommitted
selftests/sgx: Fix NULL-pointer-dereference upon early test failure
== Background == The SGX selftests track parts of the enclave binaries in an array: encl->segment_tbl[]. That array is dynamically allocated early (but not first) in the test's lifetime. The array is referenced at the end of the test in encl_delete(). == Problem == encl->segment_tbl[] can be NULL if the test fails before its allocation. That leads to a NULL-pointer-dereference in encl_delete(). This is triggered during early failures of the selftest like if the enclave binary ("test_encl.elf") is deleted. == Solution == Ensure encl->segment_tbl[] is valid before attempting to access its members. The offset with which it is accessed, encl->nr_segments, is initialized before encl->segment_tbl[] and thus considered valid to use after the encl->segment_tbl[] check succeeds. Fixes: 3200505 ("selftests/sgx: Create a heap for the test enclave") Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Acked-by: Shuah Khan <skhan@linuxfoundation.org> Link: https://lkml.kernel.org/r/90a31dfd640ea756fa324712e7cbab4a90fa7518.1644355600.git.reinette.chatre@intel.com
1 parent dfd42fa commit 2d03861

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

  • tools/testing/selftests/sgx

tools/testing/selftests/sgx/load.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121

2222
void encl_delete(struct encl *encl)
2323
{
24-
struct encl_segment *heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
24+
struct encl_segment *heap_seg;
2525

2626
if (encl->encl_base)
2727
munmap((void *)encl->encl_base, encl->encl_size);
@@ -32,10 +32,11 @@ void encl_delete(struct encl *encl)
3232
if (encl->fd)
3333
close(encl->fd);
3434

35-
munmap(heap_seg->src, heap_seg->size);
36-
37-
if (encl->segment_tbl)
35+
if (encl->segment_tbl) {
36+
heap_seg = &encl->segment_tbl[encl->nr_segments - 1];
37+
munmap(heap_seg->src, heap_seg->size);
3838
free(encl->segment_tbl);
39+
}
3940

4041
memset(encl, 0, sizeof(*encl));
4142
}

0 commit comments

Comments
 (0)