[for_v22,06/11] x86/sgx: Check the bounds of the enclave address against ELRANGE
diff mbox series

Message ID 20190808001254.11926-7-sean.j.christopherson@intel.com
State New
Headers show
Series
  • x86/sgx: Bug fixes for v22
Related show

Commit Message

Sean Christopherson Aug. 8, 2019, 12:12 a.m. UTC
Reject EADD if the destination address lies outside the bounds of the
enclave's ELRANGE as tracked by encl->base and encl->size.  Lack of a
check allows userspace to induce a #GP on EADD.

Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
 arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Jarkko Sakkinen Aug. 8, 2019, 3:45 p.m. UTC | #1
On Wed, Aug 07, 2019 at 05:12:49PM -0700, Sean Christopherson wrote:
> Reject EADD if the destination address lies outside the bounds of the
> enclave's ELRANGE as tracked by encl->base and encl->size.  Lack of a
> check allows userspace to induce a #GP on EADD.
> 
> Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>

Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

/Jarkko
Jarkko Sakkinen Aug. 9, 2019, 9:21 p.m. UTC | #2
On Thu, Aug 08, 2019 at 06:45:30PM +0300, Jarkko Sakkinen wrote:
> On Wed, Aug 07, 2019 at 05:12:49PM -0700, Sean Christopherson wrote:
> > Reject EADD if the destination address lies outside the bounds of the
> > enclave's ELRANGE as tracked by encl->base and encl->size.  Lack of a
> > check allows userspace to induce a #GP on EADD.
> > 
> > Reported-by: Shay Katz-zamir <shay.katz-zamir@intel.com>
> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> 
> Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

Applied with "patch -p1 -u" as my earlier merges screwed the ancestors.
Merged and pushed.

/Jarkko

Patch
diff mbox series

diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
index 11d90a31e7c2..6a580361e20e 100644
--- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
@@ -604,6 +604,9 @@  static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg)
 	    !IS_ALIGNED(addp.src, PAGE_SIZE))
 		return -EINVAL;
 
+	if (addp.addr < encl->base || addp.addr - encl->base >= encl->size)
+		return -EINVAL;
+
 	if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
 			   sizeof(secinfo)))
 		return -EFAULT;