[PATCH] x86/mce: Zero the injected error record before logging it

[Yifei Chu]

do_inject() declares a struct mce_hw_err on the stack and, for a
software injection, fills in only err.m from i_mce before calling
mce_log(&err). The err.vendor union (synd1/synd2, 16 bytes) is never
initialized, so it holds whatever was left on the kernel stack.

Those bytes are not dropped: the mce_record tracepoint copies
err->vendor verbatim into its v_data dynamic array, so a sw-injected
record publishes 16 bytes of stale stack to anything reading the
tracepoint. rasdaemon decodes v_data as MCA_SYND1/SYND2 supplemental
error info (e.g. FRU text), so sw injection - whose whole purpose is to
exercise the decode path - feeds the decoder nondeterministic garbage
instead of a clean record.

Every other mce_log() caller builds its record through mce_prep_record(),
which memsets the whole struct mce_hw_err first. do_inject() is the only
one that skips it.

Zero-initialize the record so the vendor data of an injected MCE is
always well defined. err.m is still fully overwritten by i_mce
immediately afterwards, so the injected machine check fields are
unchanged.

Reproduced with CONFIG_X86_MCE_INJECT: writing "sw" to flags and
injecting a bank/status makes the mce_record tracepoint print random
vendor data, e.g.

    vendor data: {0xb3,0x8a,0xb5,0x41,0x0,0x0,0x0,0x0,
                  0x67,0x93,0xbc,0xa8,0xff,0xff,0xff,0xff}

Fixes: d4fca1358ea9 ("x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Abaci <abaci@xxxxxxxxxxxxxxxxx>
Assisted-by: abaci:qwen3.8-max
Signed-off-by: Yifei Chu <Chuyf26@xxxxxxxxxxxxxxxxx>
---
 arch/x86/kernel/cpu/mce/inject.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
index 6f8a49d..a6d8f8e 100644
--- a/arch/x86/kernel/cpu/mce/inject.c
+++ b/arch/x86/kernel/cpu/mce/inject.c
@@ -504,7 +504,7 @@ static void prepare_msrs(void *info)
 static void do_inject(void)
 {
 	unsigned int cpu = i_mce.extcpu;
-	struct mce_hw_err err;
+	struct mce_hw_err err = {};
 	u64 mcg_status = 0;
 	u8 b = i_mce.bank;
 
-- 
2.43.5