[PATCH] x86/mce: Zero the injected error record before logging it

[PATCH] x86/mce: Zero the injected error record before logging it

[Yifei Chu]

do_inject() declares a struct mce_hw_err on the stack and, for a
software injection, fills in only err.m from i_mce before calling
mce_log(&err). The err.vendor union (synd1/synd2, 16 bytes) is never
initialized, so it holds whatever was left on the kernel stack.

Those bytes are not dropped: the mce_record tracepoint copies
err->vendor verbatim into its v_data dynamic array, so a sw-injected
record publishes 16 bytes of stale stack to anything reading the
tracepoint. rasdaemon decodes v_data as MCA_SYND1/SYND2 supplemental
error info (e.g. FRU text), so sw injection - whose whole purpose is to
exercise the decode path - feeds the decoder nondeterministic garbage
instead of a clean record.

Every other mce_log() caller builds its record through mce_prep_record(),
which memsets the whole struct mce_hw_err first. do_inject() is the only
one that skips it.

Zero-initialize the record so the vendor data of an injected MCE is
always well defined. err.m is still fully overwritten by i_mce
immediately afterwards, so the injected machine check fields are
unchanged.

Reproduced with CONFIG_X86_MCE_INJECT: writing "sw" to flags and
injecting a bank/status makes the mce_record tracepoint print random
vendor data, e.g.

    vendor data: {0xb3,0x8a,0xb5,0x41,0x0,0x0,0x0,0x0,
                  0x67,0x93,0xbc,0xa8,0xff,0xff,0xff,0xff}

Fixes: d4fca1358ea9 ("x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers")
Cc: stable@vger.kernel.org
Reported-by: Abaci <abaci@linux.alibaba.com>
Assisted-by: abaci:qwen3.8-max
Signed-off-by: Yifei Chu <Chuyf26@linux.alibaba.com>
---
 arch/x86/kernel/cpu/mce/inject.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
index 6f8a49d..a6d8f8e 100644
--- a/arch/x86/kernel/cpu/mce/inject.c
+++ b/arch/x86/kernel/cpu/mce/inject.c
@@ -504,7 +504,7 @@ static void prepare_msrs(void *info)
 static void do_inject(void)
 {
 	unsigned int cpu = i_mce.extcpu;
-	struct mce_hw_err err;
+	struct mce_hw_err err = {};
 	u64 mcg_status = 0;
 	u8 b = i_mce.bank;
 
-- 
2.43.5

Re: [PATCH] x86/mce: Zero the injected error record before logging it

[Borislav Petkov]

On Thu, Sep 10, 2026 at 11:32:17AM +0800, Yifei Chu wrote:
> Reproduced with CONFIG_X86_MCE_INJECT: writing "sw" to flags and
> injecting a bank/status makes the mce_record tracepoint print random
> vendor data, e.g.
> 
>     vendor data: {0xb3,0x8a,0xb5,0x41,0x0,0x0,0x0,0x0,
>                   0x67,0x93,0xbc,0xa8,0xff,0xff,0xff,0xff}

And? Who cares?

> Fixes: d4fca1358ea9 ("x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers")
> Cc: stable@vger.kernel.org

Backport it everywhere? A MCE injection fix?

You must be joking.

> Reported-by: Abaci <abaci@linux.alibaba.com>
> Assisted-by: abaci:qwen3.8-max

This is now

Assisted-by: LLM

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette