| Message ID | 0d91ac79-6d84-abed-5821-4dbe59fa1a38@invisiblethingslab.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/sgx: Add overflow check in sgx_validate_offset_length() | expand |
On Wed, Oct 05, 2022 at 12:59:03AM +0200, Borys wrote: > sgx_validate_offset_length() function verifies "offset" and "length" > arguments provided by userspace, but was missing an overflow check on > their addition. > This code was originally introduced in commit c6d26d370767 ("x86/sgx: > Add SGX_IOC_ENCLAVE_ADD_PAGES") and later refactored in commit > dda03e2c331b ("x86/sgx: Create utility to validate user provided offset > and length"). > > Fixes: c6d26d370767 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES") > Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com> > --- > Applies on top of tip/x86/sgx ee56a283988d739c25d2d00ffb22707cb487ab47 > > arch/x86/kernel/cpu/sgx/ioctl.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c > index ebe79d60619f..da8b8ea6b063 100644 > --- a/arch/x86/kernel/cpu/sgx/ioctl.c > +++ b/arch/x86/kernel/cpu/sgx/ioctl.c > @@ -356,6 +356,9 @@ static int sgx_validate_offset_length(struct sgx_encl *encl, > if (!length || !IS_ALIGNED(length, PAGE_SIZE)) > return -EINVAL; > > + if (offset + length < offset) > + return -EINVAL; > + > if (offset + length - PAGE_SIZE >= encl->size) > return -EINVAL; > > -- > 2.37.3 > Thank you. Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> BTW, needs: Cc: stable@vger.kernel.org # v5.11+ BR, Jarkko
(Move x86 maintainers to "To:") Hi Maintainers, Could you please consider this fix for inclusion? Thank you very much Reinette On 10/4/2022 4:15 PM, Jarkko Sakkinen wrote: > On Wed, Oct 05, 2022 at 12:59:03AM +0200, Borys wrote: >> sgx_validate_offset_length() function verifies "offset" and "length" >> arguments provided by userspace, but was missing an overflow check on >> their addition. >> This code was originally introduced in commit c6d26d370767 ("x86/sgx: >> Add SGX_IOC_ENCLAVE_ADD_PAGES") and later refactored in commit >> dda03e2c331b ("x86/sgx: Create utility to validate user provided offset >> and length"). >> >> Fixes: c6d26d370767 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES") >> Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com> >> --- >> Applies on top of tip/x86/sgx ee56a283988d739c25d2d00ffb22707cb487ab47 >> >> arch/x86/kernel/cpu/sgx/ioctl.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c >> index ebe79d60619f..da8b8ea6b063 100644 >> --- a/arch/x86/kernel/cpu/sgx/ioctl.c >> +++ b/arch/x86/kernel/cpu/sgx/ioctl.c >> @@ -356,6 +356,9 @@ static int sgx_validate_offset_length(struct sgx_encl *encl, >> if (!length || !IS_ALIGNED(length, PAGE_SIZE)) >> return -EINVAL; >> >> + if (offset + length < offset) >> + return -EINVAL; >> + >> if (offset + length - PAGE_SIZE >= encl->size) >> return -EINVAL; >> >> -- >> 2.37.3 >> > > Thank you. > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> > > BTW, needs: > > Cc: stable@vger.kernel.org # v5.11+ > > BR, Jarkko
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index ebe79d60619f..da8b8ea6b063 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -356,6 +356,9 @@ static int sgx_validate_offset_length(struct sgx_encl *encl, if (!length || !IS_ALIGNED(length, PAGE_SIZE)) return -EINVAL; + if (offset + length < offset) + return -EINVAL; + if (offset + length - PAGE_SIZE >= encl->size) return -EINVAL;
sgx_validate_offset_length() function verifies "offset" and "length" arguments provided by userspace, but was missing an overflow check on their addition. This code was originally introduced in commit c6d26d370767 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES") and later refactored in commit dda03e2c331b ("x86/sgx: Create utility to validate user provided offset and length"). Fixes: c6d26d370767 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES") Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com> --- Applies on top of tip/x86/sgx ee56a283988d739c25d2d00ffb22707cb487ab47 arch/x86/kernel/cpu/sgx/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)