From patchwork Mon Jan 9 16:08:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Gonda X-Patchwork-Id: 13093811 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68A37C678D5 for ; Mon, 9 Jan 2023 16:08:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235943AbjAIQIW (ORCPT ); Mon, 9 Jan 2023 11:08:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237239AbjAIQIR (ORCPT ); Mon, 9 Jan 2023 11:08:17 -0500 Received: from mail-pf1-x44a.google.com (mail-pf1-x44a.google.com [IPv6:2607:f8b0:4864:20::44a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46F7B3AAB9 for ; Mon, 9 Jan 2023 08:08:15 -0800 (PST) Received: by mail-pf1-x44a.google.com with SMTP id 12-20020a62160c000000b005808c2cd0b6so3674156pfw.12 for ; Mon, 09 Jan 2023 08:08:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:mime-version:message-id:date:from:to:cc:subject :date:message-id:reply-to; bh=xyECd1rsW3exJndECu8q+ev3KdOyDWWEbigO77NqdCk=; b=kdlmONTLmbqdAZs/NBYP9jUdOxLAvA9jdwZbpjHZ3tHyjKxTjfuYCoDYum07dI89m+ QA/38bTswLYyeXsN3mwxQyODhROjF+E9OSa+b5n97FSe7w+0ZmqtrE/RjlL9NqxaHuz3 CRMS65fzgV2Qdurg0/02eiWhqj8bUG5iObMSWz+AFwR+TTc0yH30HL5Ygupu9JDCxzx7 vXXo16GwV7Lw54C1yComnMOTMBkzkm3Uu8vjLepmcAGGJvEMaRhdqT3JvZAjXcLPbl3Q 8V4xupbRgxh9G8haSYFa/ZQow09ZZYa7EG/tKB7LxTa5ns9ZKgc6nJ78eKvktKo/tRWO GrPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:mime-version:message-id:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=xyECd1rsW3exJndECu8q+ev3KdOyDWWEbigO77NqdCk=; b=f6T41KHQaMP8LTOzBAhk0jEdPE5Phy7QH3IRwZaW7s5R5u302H3BXedYAJS3TvxniI G6JzoyiQbedV7mPb+1tynoMLT7BHbkpvRBYWdP+Uf/1UY+OrrCXiFiikqGxV8sgFt+Vj apWLVdC0Sg2m4loVr1RupKG6KCFG9baP6vOqIAV6hWHDRSU6sM/LqX/s5kzn9/ilNVgB k30FRqyELiRVFAeuFLU7seSVFG3yN1N6a957ekPtbyEhQMoUClD0o6Jjb+mRxNo1rpDa YV4h48XszornuvGy+d4KggsBg90Ic62RqswUFjHcK9eN6MbfwRaMq/KxsBsyVkuZsPDu 2IVg== X-Gm-Message-State: AFqh2krLzdfJ/NmGWXbSYZF8989PDoNxyORAx6LLQQAGNfBgtY4XCG+K HZ0if5P2SU3QBhP7fRzNdd8liEITBCdbxIpby456kdfCvB6bq1Ga/XRZlQfn1VJPIOzrkZgMVyw A+kL4kG72Cr/yxapS7nhHWnXk1vsdmjHxDi/FCDLjileYVxwm1eUYZRHRtQ== X-Google-Smtp-Source: AMrXdXtfd2sfBIxNw+Rxy/KydCOZGP1eQYUZB45FYydRThzpSXrCW/RZvZm+D+uYBJzZ6R3Ukg06UrfuG1g= X-Received: from pgonda1.kir.corp.google.com ([2620:0:1008:11:ca:b043:174:2b96]) (user=pgonda job=sendgmr) by 2002:a17:902:8213:b0:192:a805:29d with SMTP id x19-20020a170902821300b00192a805029dmr2217114pln.31.1673280494640; Mon, 09 Jan 2023 08:08:14 -0800 (PST) Date: Mon, 9 Jan 2023 08:08:08 -0800 Message-Id: <20230109160808.3618132-1-pgonda@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.39.0.314.g84b9a713c41-goog Subject: [PATCH] KVM: sev: Fix int overflow in send|recieve_update_data ioctls From: Peter Gonda To: kvm@vger.kernel.org Cc: Peter Gonda , Andy Nguyen , Thomas Lendacky , David Rientjes , Paolo Bonzini , Sean Christopherson , stable@vger.kernel.org, linux-kernel@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer overflow issue. Params.guest_len and offset are both 32bite wide, with a large params.guest_len the check to confirm a page boundary is not crossed can falsely pass: /* Check if we are crossing the page boundary * offset = params.guest_uaddr & (PAGE_SIZE - 1); if ((params.guest_len + offset > PAGE_SIZE)) Add an additional check to this conditional to confirm that params.guest_len itself is not greater than PAGE_SIZE. The current code is can only overflow with a params.guest_len of greater than 0xfffff000. And the FW spec says these commands fail with lengths greater than 16KB. So this issue should not be a security concern Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") Reported-by: Andy Nguyen Suggested-by: Thomas Lendacky Signed-off-by: Peter Gonda Cc: David Rientjes Cc: Paolo Bonzini Cc: Sean Christopherson Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- arch/x86/kvm/svm/sev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 273cba809328..9451de72f917 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1294,7 +1294,7 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) /* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset > PAGE_SIZE)) return -EINVAL; /* Pin guest memory */ @@ -1474,7 +1474,7 @@ static int sev_receive_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) /* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset > PAGE_SIZE)) return -EINVAL; hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);