Message ID | 20230207171354.4012821-1-pgonda@google.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | [V2] KVM: sev: Fix potential overflow send|recieve_update_data | expand |
On 2/7/23 11:13, Peter Gonda wrote: > KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer > overflow issue. Params.guest_len and offset are both 32bite wide, with a > large params.guest_len the check to confirm a page boundary is not > crossed can falsely pass: > > /* Check if we are crossing the page boundary * > offset = params.guest_uaddr & (PAGE_SIZE - 1); > if ((params.guest_len + offset > PAGE_SIZE)) > > Add an additional check to this conditional to confirm that > params.guest_len itself is not greater than PAGE_SIZE. > > The current code is can only overflow with a params.guest_len of greater > than 0xfffff000. And the FW spec says these commands fail with lengths > greater than 16KB. So this issue should not be a security concern > > Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") > Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") > Reported-by: Andy Nguyen <theflow@google.com> > Suggested-by: Thomas Lendacky <thomas.lendacky@amd.com> > Signed-off-by: Peter Gonda <pgonda@google.com> > Cc: David Rientjes <rientjes@google.com> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Sean Christopherson <seanjc@google.com> > Cc: kvm@vger.kernel.org > Cc: stable@vger.kernel.org > Cc: linux-kernel@vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > > V2 > * Updated conditional based on feedback from Tom. > > --- > arch/x86/kvm/svm/sev.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 273cba809328..3d74facaead8 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -1294,7 +1294,7 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) > > /* Check if we are crossing the page boundary */ > offset = params.guest_uaddr & (PAGE_SIZE - 1); > - if ((params.guest_len + offset > PAGE_SIZE)) > + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) > return -EINVAL; > > /* Pin guest memory */ > @@ -1474,7 +1474,7 @@ static int sev_receive_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) > > /* Check if we are crossing the page boundary */ > offset = params.guest_uaddr & (PAGE_SIZE - 1); > - if ((params.guest_len + offset > PAGE_SIZE)) > + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) > return -EINVAL; > > hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);
For now at least, I want to keep with "KVM: SVM:" instead of using "KVM: SEV:". Many commits that touch SEV aren't strictly isolated to SEV, which means the "SEV" tag is unreliable. There's also the question of taggin SEV vs. SEV-ES vs. SEV-SNP. It's usually easy enough to squeeze SEV (or SEV-ES or SNP) into the shortlog, e.g. KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() On Tue, Feb 07, 2023, Peter Gonda wrote: > KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer > overflow issue. Params.guest_len and offset are both 32bite wide, with a "32 bits" > large params.guest_len the check to confirm a page boundary is not > crossed can falsely pass: > > /* Check if we are crossing the page boundary * > offset = params.guest_uaddr & (PAGE_SIZE - 1); > if ((params.guest_len + offset > PAGE_SIZE)) > > Add an additional check to this conditional to confirm that Eh, "to this conditional" is unnecessarily precise. > params.guest_len itself is not greater than PAGE_SIZE. > > The current code is can only overflow with a params.guest_len of greater "is can", though I vote to omit the "current code" part entirely, it should be obvious that this is talking about the pre-patched code. > than 0xfffff000. And the FW spec says these commands fail with lengths > greater than 16KB. So this issue should not be a security concern Slightly reworded, how about this for the "not a security concern" disclaimer? Note, this isn't a security concern as overflow can happen if and only if params.guest_len is greater than 0xfffff000, and the FW spec says these commands fail with lengths greater than 16KB, i.e. the PSP will detect KVM's goof. No need to send a v3, I'll fix up the changelog when applying. Holler if you disagree with anything though. Thanks!
On Tue, 07 Feb 2023 09:13:54 -0800, Peter Gonda wrote: > KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer > overflow issue. Params.guest_len and offset are both 32bite wide, with a > large params.guest_len the check to confirm a page boundary is not > crossed can falsely pass: > > /* Check if we are crossing the page boundary * > offset = params.guest_uaddr & (PAGE_SIZE - 1); > if ((params.guest_len + offset > PAGE_SIZE)) > > [...] Applied to kvm-x86 svm, thanks! [1/1] KVM: sev: Fix potential overflow send|recieve_update_data https://github.com/kvm-x86/linux/commit/f94f053aa3a5 -- https://github.com/kvm-x86/linux/tree/next https://github.com/kvm-x86/linux/tree/fixes
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 273cba809328..3d74facaead8 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1294,7 +1294,7 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) /* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) return -EINVAL; /* Pin guest memory */ @@ -1474,7 +1474,7 @@ static int sev_receive_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) /* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) return -EINVAL; hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);
KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer overflow issue. Params.guest_len and offset are both 32bite wide, with a large params.guest_len the check to confirm a page boundary is not crossed can falsely pass: /* Check if we are crossing the page boundary * offset = params.guest_uaddr & (PAGE_SIZE - 1); if ((params.guest_len + offset > PAGE_SIZE)) Add an additional check to this conditional to confirm that params.guest_len itself is not greater than PAGE_SIZE. The current code is can only overflow with a params.guest_len of greater than 0xfffff000. And the FW spec says these commands fail with lengths greater than 16KB. So this issue should not be a security concern Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") Reported-by: Andy Nguyen <theflow@google.com> Suggested-by: Thomas Lendacky <thomas.lendacky@amd.com> Signed-off-by: Peter Gonda <pgonda@google.com> Cc: David Rientjes <rientjes@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Sean Christopherson <seanjc@google.com> Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- V2 * Updated conditional based on feedback from Tom. --- arch/x86/kvm/svm/sev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)