| Message ID | 20190808001254.11926-5-sean.j.christopherson@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/sgx: Bug fixes for v22 | expand |
On Wed, Aug 07, 2019 at 05:12:47PM -0700, Sean Christopherson wrote: > Check that the destination enclave address is page aligned, i.e. bits > 11:0 are zero. The userspace controlled address is used to initialize > page->desc, e.g. userspace can set kernel-internal flags by passing in > an unaligned address. > > Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> /Jarkko
diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c index ebb71eb3323a..ae381bf4cfd7 100644 --- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c @@ -600,6 +600,9 @@ static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg) if (copy_from_user(&addp, arg, sizeof(addp))) return -EFAULT; + if (!IS_ALIGNED(addp.addr, PAGE_SIZE)) + return -EINVAL; + if (copy_from_user(&secinfo, (void __user *)addp.secinfo, sizeof(secinfo))) return -EFAULT;
Check that the destination enclave address is page aligned, i.e. bits 11:0 are zero. The userspace controlled address is used to initialize page->desc, e.g. userspace can set kernel-internal flags by passing in an unaligned address. Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> --- arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)