kmsan: unpoison values coming from X86 special registers

Fuzzing the kernel with KVM enabled leads to bug reports originating from these registers.
google · Oct 18, 2018 · 21e22c2 · 21e22c2
1 parent 79ff673
commit 21e22c2
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
@@ -222,11 +222,13 @@ static inline void native_load_idt(const struct desc_ptr *dtr)
 static inline void native_store_gdt(struct desc_ptr *dtr)
 {
 	asm volatile("sgdt %0":"=m" (*dtr));
+	kmsan_unpoison_shadow(dtr, sizeof(struct desc_ptr));
 }
 
 static inline void store_idt(struct desc_ptr *dtr)
 {
 	asm volatile("sidt %0":"=m" (*dtr));
+	kmsan_unpoison_shadow(dtr, sizeof(struct desc_ptr));
 }
 
 /*

diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
@@ -18,7 +18,8 @@ extern unsigned long __force_order;
 
 static inline unsigned long native_read_cr0(void)
 {
-	unsigned long val;
+	// TODO(glider): suppressing a false positive.
+	unsigned long val = 0;
 	asm volatile("mov %%cr0,%0\n\t" : "=r" (val), "=m" (__force_order));
 	return val;
 }
@@ -30,7 +31,8 @@ static inline void native_write_cr0(unsigned long val)
 
 static inline unsigned long native_read_cr2(void)
 {
-	unsigned long val;
+	// TODO(glider): suppressing a false positive.
+	unsigned long val = 0;
 	asm volatile("mov %%cr2,%0\n\t" : "=r" (val), "=m" (__force_order));
 	return val;
 }
@@ -42,7 +44,8 @@ static inline void native_write_cr2(unsigned long val)
 
 static inline unsigned long __native_read_cr3(void)
 {
-	unsigned long val;
+	// TODO(glider): suppressing a false positive.
+	unsigned long val = 0;
 	asm volatile("mov %%cr3,%0\n\t" : "=r" (val), "=m" (__force_order));
 	return val;
 }
@@ -54,6 +57,7 @@ static inline void native_write_cr3(unsigned long val)
 
 static inline unsigned long native_read_cr4(void)
 {
+	// TODO(glider): suppressing a false positive.
 	unsigned long val;
 #ifdef CONFIG_X86_32
 	/*
@@ -80,6 +84,7 @@ static inline void native_write_cr4(unsigned long val)
 #ifdef CONFIG_X86_64
 static inline unsigned long native_read_cr8(void)
 {
+	// TODO(glider): suppressing a false positive.
 	unsigned long cr8;
 	asm volatile("movq %%cr8,%0" : "=r" (cr8));
 	return cr8;