| Message ID | 20190808001254.11926-7-sean.j.christopherson@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/sgx: Bug fixes for v22 | expand |
On Wed, Aug 07, 2019 at 05:12:49PM -0700, Sean Christopherson wrote: > Reject EADD if the destination address lies outside the bounds of the > enclave's ELRANGE as tracked by encl->base and encl->size. Lack of a > check allows userspace to induce a #GP on EADD. > > Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> /Jarkko
On Thu, Aug 08, 2019 at 06:45:30PM +0300, Jarkko Sakkinen wrote: > On Wed, Aug 07, 2019 at 05:12:49PM -0700, Sean Christopherson wrote: > > Reject EADD if the destination address lies outside the bounds of the > > enclave's ELRANGE as tracked by encl->base and encl->size. Lack of a > > check allows userspace to induce a #GP on EADD. > > > > Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com> > > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> > > Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Applied with "patch -p1 -u" as my earlier merges screwed the ancestors. Merged and pushed. /Jarkko
diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c index 11d90a31e7c2..6a580361e20e 100644 --- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c @@ -604,6 +604,9 @@ static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg) !IS_ALIGNED(addp.src, PAGE_SIZE)) return -EINVAL; + if (addp.addr < encl->base || addp.addr - encl->base >= encl->size) + return -EINVAL; + if (copy_from_user(&secinfo, (void __user *)addp.secinfo, sizeof(secinfo))) return -EFAULT;
Reject EADD if the destination address lies outside the bounds of the enclave's ELRANGE as tracked by encl->base and encl->size. Lack of a check allows userspace to induce a #GP on EADD. Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> --- arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)