sgx reserved memory is not initialized

[cmickeyb]

Thanks for filing a bug or defect report! Please fill out the TODOs below.

Subject of the issue

In os_mmap() in sgx_platform.c memory is allocated from sgx reserved memory. There is no guarantee that the memory will be zero'd out. In particular, this can be a problem if multiple execution environments are created (where reserved memory is allocated and then deallocated multiple times).

Test case

Not relevant.

Your environment

• Ubuntu 24.04
• WAMR 2.4.1 on SGX

Steps to reproduce

Create and destroy an execution environment repeatedly. The memory returned from SGX will have the data from the previous execution environment (it is not reset).

Expected behavior

Each invocation should be independent.

Actual behavior

Tell us what happens instead

Extra Info

A fairly simple memset on allocation solves the problem. A slightly more performant version which assumes the initial allocation is zero'd out memset's the memory when it is returned to the sgx reserved memory pool in munump.

[ikehara]

I actually ran into this issue. When the memory is expanded (memory.grow), it results in an out-of-bounds access.

./sgx_test.sh aot
...
Running AOT test...
Exception: out of bounds memory access

After repeating memory allocation and release with os_remap() several times, regions that are not zero-cleared get allocated, which causes problems.

Here’s the script to reproduce the issue:

#!/bin/bash

set -e

. /opt/sgxsdk/environment

# 1. Create Go main
cat <<EOF > main.go
package main
import "fmt"
func main() {
	// Allocate 1MB
	size := 1 * 1024 * 1024
	b := make([]byte, size)
	for i := range b {
		b[i] = byte(i)
	}
	fmt.Println("Allocated", len(b), "bytes")
}
EOF

# 2. Build WASM file
# GOOS=wasip1 GOARCH=wasm go build -o main.wasm main.go
tinygo build -o main.wasm -target=wasi main.go

# 3. (AOT only) Build LLVM, wamrc, and compile WASM to AOT if needed
TEST_MODE="wasm" # default is WASM
if [ "$1" = "aot" ]; then
	TEST_MODE="aot"
fi

if [ "$TEST_MODE" = "aot" ]; then
	# Ensure llvm exists for wamrc
	if [ ! -d core/deps/llvm ]; then
		echo "llvm not found, running build_llvm.sh..."
		(cd wamr-compiler && ./build_llvm.sh)
	fi
	# Build wamrc (AOT compiler)
	(cd wamr-compiler && rm -rf build && mkdir -p build && cd build && cmake .. && cmake --build . -j)
	# Compile WASM to AOT
	./wamr-compiler/build/wamrc -sgx -o main.aot main.wasm
fi

# 4. Build Minimal SGX iwasm
(cd product-mini/platforms/linux-sgx && rm -rf build && mkdir -p build && cd build && cmake .. -DWAMR_BUILD_SIMD=0 && cmake --build . -j)

# 5. Patch ReservedMemMaxSize in Enclave.config.xml
CONFIG_XML=product-mini/platforms/linux-sgx/enclave-sample/Enclave/Enclave.config.xml
if grep -q '<ReservedMemMaxSize>' "$CONFIG_XML"; then
	sed -i 's|<ReservedMemMaxSize>.*</ReservedMemMaxSize>|<ReservedMemMaxSize>0x10000000</ReservedMemMaxSize>|' "$CONFIG_XML"
fi

# 6. Build enclave-sample
(cd product-mini/platforms/linux-sgx/enclave-sample && make clean && make)

# 7. Run test with iwasm (AOT or WASM selectable)
if [ "$TEST_MODE" = "aot" ]; then
	echo "Running AOT test..."
	./product-mini/platforms/linux-sgx/enclave-sample/iwasm main.aot
else
	echo "Running WASM test..."
	./product-mini/platforms/linux-sgx/enclave-sample/iwasm main.wasm
fi

[ikehara]

I was just about to create a simple PR, but simply zero-clearing inside os_mmap() would cause unnecessary zero-clearing when using os_mremap(). So, it might be better to implement an SGX-specific version of os_mremap() at the same time.

--- a/core/shared/platform/linux-sgx/sgx_platform.c
+++ b/core/shared/platform/linux-sgx/sgx_platform.c
@@ -161,6 +161,8 @@ os_mmap(void *hint, size_t size, int prot, int flags, os_file_handle file)
         return NULL;
     }
 
+    memset(ret, 0, aligned_size);
+
     if (prot & MMAP_PROT_READ)
         mprot |= SGX_PROT_READ;
     if (prot & MMAP_PROT_WRITE)