From patchwork Thu Dec 5 10:01:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 11274599 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CB119930 for ; Thu, 5 Dec 2019 10:02:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A8F6C24651 for ; Thu, 5 Dec 2019 10:02:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728955AbfLEKCC (ORCPT ); Thu, 5 Dec 2019 05:02:02 -0500 Received: from mga05.intel.com ([192.55.52.43]:43804 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726239AbfLEKCC (ORCPT ); Thu, 5 Dec 2019 05:02:02 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Dec 2019 02:02:01 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,281,1571727600"; d="scan'208";a="214137872" Received: from jsakkine-mobl1.fi.intel.com (HELO localhost) ([10.237.66.112]) by orsmga003.jf.intel.com with ESMTP; 05 Dec 2019 02:01:58 -0800 From: Jarkko Sakkinen To: linux-sgx@vger.kernel.org Cc: Jarkko Sakkinen , Sean Christopherson , Huang Haitao Subject: [PATCH] x86/sgx: Fix double-free when EADD fails Date: Thu, 5 Dec 2019 12:01:51 +0200 Message-Id: <20191205100151.18950-1-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Sender: linux-sgx-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org radix_tree_delete() gets called twice for the same page when EADD fails. This commit fixes the issue. Cc: Sean Christopherson Reported-by: Huang Haitao Signed-off-by: Jarkko Sakkinen --- arch/x86/kernel/cpu/sgx/ioctl.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index ab9e48cd294b..2ff12038a8a4 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -413,13 +413,8 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src, ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo, src); - if (ret) { - /* ENCLS failure. */ - if (ret == -EIO) - sgx_encl_destroy(encl); - + if (ret) goto err_out; - } /* * Complete the "add" before doing the "extend" so that the "add" @@ -432,17 +427,12 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src, if (flags & SGX_PAGE_MEASURE) { ret = __sgx_encl_extend(encl, epc_page); - - /* ENCLS failure. */ - if (ret) { - sgx_encl_destroy(encl); - goto out_unlock; - } + if (ret) + goto err_out; } sgx_mark_page_reclaimable(encl_page->epc_page); -out_unlock: mutex_unlock(&encl->lock); up_read(¤t->mm->mmap_sem); return ret; @@ -460,6 +450,13 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src, sgx_free_page(epc_page); kfree(encl_page); + /* + * Destroy enclave on ENCLS failure as this means that EPC has been + * invalidated. + */ + if (ret == -EIO) + sgx_encl_destroy(encl); + return ret; }