From: Tycho Andersen <tycho@kernel.org>
To: Tom Lendacky <thomas.lendacky@amd.com>,
John Allen <john.allen@amd.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Ashish Kalra <ashish.kalra@amd.com>
Cc: "Borislav Petkov (AMD)" <bp@alien8.de>,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
Brijesh Singh <brijesh.singh@amd.com>,
Michael Roth <michael.roth@amd.com>,
Alexey Kardashevskiy <aik@amd.com>,
Dan Williams <dan.j.williams@intel.com>,
"Tycho Andersen (AMD)" <tycho@kernel.org>
Subject: [PATCH v1 4/4] crypto/ccp: Initialize data during __sev_snp_init_locked()
Date: Wed, 8 Apr 2026 08:32:59 -0600 [thread overview]
Message-ID: <20260408143259.602767-5-tycho@kernel.org> (raw)
In-Reply-To: <20260408143259.602767-1-tycho@kernel.org>
From: "Tycho Andersen (AMD)" <tycho@kernel.org>
Sashiko notes:
> is the stack variable data left uninitialized when taking the else branch?
> Since data.tio_en is later evaluated unconditionally, could stack garbage
> cause it to evaluate to true, leading to erroneous attempts to allocate
> pages and initialize SEV-TIO on unsupported hardware?
If the firmware is too old to support SEV_INIT_EX, data is left
uninitialized but used in the debug logging about whether TIO is enabled or
not.
Fixes: 4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
Reported-by: Sashiko
Assisted-by: Gemini:gemini-3.1-pro-preview
Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kernel.org
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 11e2c667c0ad..7b8c1b44f2da 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -1356,7 +1356,7 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
{
struct sev_data_range_list *snp_range_list __free(kfree) = NULL;
struct psp_device *psp = psp_master;
- struct sev_data_snp_init_ex data;
+ struct sev_data_snp_init_ex data = {};
struct sev_device *sev;
void *arg = &data;
int cmd, rc = 0;
@@ -1420,8 +1420,6 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
*/
snp_add_hv_fixed_pages(sev, snp_range_list);
- memset(&data, 0, sizeof(data));
-
if (max_snp_asid) {
data.ciphertext_hiding_en = 1;
data.max_snp_asid = max_snp_asid;
--
2.53.0
next prev parent reply other threads:[~2026-04-08 14:34 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-08 14:32 [PATCH v1 0/4] Fix some bugs in the CCP driver Tycho Andersen
2026-04-08 14:32 ` [PATCH v1 1/4] crypto/ccp: Reverse the cleanup order in psp_dev_destroy() Tycho Andersen
2026-04-08 14:32 ` [PATCH v1 2/4] crypto/ccp: Fix snp_filter_reserved_mem_regions() off-by-one Tycho Andersen
2026-04-08 14:32 ` [PATCH v1 3/4] crypto/ccp: Check for page allocation failure correctly in TIO Tycho Andersen
2026-04-08 14:32 ` Tycho Andersen [this message]
2026-05-04 19:48 ` [PATCH v1 0/4] Fix some bugs in the CCP driver Tom Lendacky
2026-05-05 8:40 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260408143259.602767-5-tycho@kernel.org \
--to=tycho@kernel.org \
--cc=aik@amd.com \
--cc=ashish.kalra@amd.com \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=dan.j.williams@intel.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=john.allen@amd.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michael.roth@amd.com \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.