[for_v22,04/11] x86/sgx: x86/sgx: Require EADD destination to be page aligned
diff mbox series

Message ID 20190808001254.11926-5-sean.j.christopherson@intel.com
State New
Headers show
Series
  • x86/sgx: Bug fixes for v22
Related show

Commit Message

Sean Christopherson Aug. 8, 2019, 12:12 a.m. UTC
Check that the destination enclave address is page aligned, i.e. bits
11:0 are zero.  The userspace controlled address is used to initialize
page->desc, e.g. userspace can set kernel-internal flags by passing in
an unaligned address.

Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
 arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Jarkko Sakkinen Aug. 8, 2019, 3:38 p.m. UTC | #1
On Wed, Aug 07, 2019 at 05:12:47PM -0700, Sean Christopherson wrote:
> Check that the destination enclave address is page aligned, i.e. bits
> 11:0 are zero.  The userspace controlled address is used to initialize
> page->desc, e.g. userspace can set kernel-internal flags by passing in
> an unaligned address.
> 
> Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>

Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

/Jarkko

Patch
diff mbox series

diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
index ebb71eb3323a..ae381bf4cfd7 100644
--- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
@@ -600,6 +600,9 @@  static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg)
 	if (copy_from_user(&addp, arg, sizeof(addp)))
 		return -EFAULT;
 
+	if (!IS_ALIGNED(addp.addr, PAGE_SIZE))
+		return -EINVAL;
+
 	if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
 			   sizeof(secinfo)))
 		return -EFAULT;