* [PATCH] KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command
@ 2018-02-23 18:36 Brijesh Singh
2018-02-24 0:19 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: Brijesh Singh @ 2018-02-23 18:36 UTC (permalink / raw)
To: kvm
Cc: Al Viro, Brijesh Singh, Paolo Bonzini,
Radim Krčmář,
Borislav Petkov, Tom Lendacky, linux-kernel, Joerg Roedel
Using the access_ok() to validate the input before issuing the SEV
command does not buy us anything in this case. If userland is
giving us a garbage pointer then copy_to_user() will catch it when we try
to return the measurement.
Suggested-by: Al Viro <viro@ZenIV.linux.org.uk>
Fixes: 0d0736f76347 (KVM: SVM: Add support for KVM_SEV_LAUNCH_MEASURE ...)
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: linux-kernel@vger.kernel.org
Cc: Joerg Roedel <joro@8bytes.org>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
We no longer need patch [1]. This patch implements Al Viro's recommendation [2]
[1] https://marc.info/?l=linux-kernel&m=151905677729098&w=2.
[2] https://marc.info/?l=linux-kernel&m=151923536116467&w=2
arch/x86/kvm/svm.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b3e488a74828..ca69d53d7e6d 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -6236,16 +6236,18 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
{
+ void __user *measure = (void __user *)(uintptr_t)argp->data;
struct kvm_sev_info *sev = &kvm->arch.sev_info;
struct sev_data_launch_measure *data;
struct kvm_sev_launch_measure params;
+ void __user *p = NULL;
void *blob = NULL;
int ret;
if (!sev_guest(kvm))
return -ENOTTY;
- if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
+ if (copy_from_user(¶ms, measure, sizeof(params)))
return -EFAULT;
data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -6256,17 +6258,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
if (!params.len)
goto cmd;
- if (params.uaddr) {
+ p = (void __user *)(uintptr_t)params.uaddr;
+ if (p) {
if (params.len > SEV_FW_BLOB_MAX_SIZE) {
ret = -EINVAL;
goto e_free;
}
- if (!access_ok(VERIFY_WRITE, params.uaddr, params.len)) {
- ret = -EFAULT;
- goto e_free;
- }
-
ret = -ENOMEM;
blob = kmalloc(params.len, GFP_KERNEL);
if (!blob)
@@ -6290,13 +6288,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
goto e_free_blob;
if (blob) {
- if (copy_to_user((void __user *)(uintptr_t)params.uaddr, blob, params.len))
+ if (copy_to_user(p, blob, params.len))
ret = -EFAULT;
}
done:
params.len = data->len;
- if (copy_to_user((void __user *)(uintptr_t)argp->data, ¶ms, sizeof(params)))
+ if (copy_to_user(measure, ¶ms, sizeof(params)))
ret = -EFAULT;
e_free_blob:
kfree(blob);
--
2.14.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command
2018-02-23 18:36 [PATCH] KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command Brijesh Singh
@ 2018-02-24 0:19 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2018-02-24 0:19 UTC (permalink / raw)
To: Brijesh Singh, kvm
Cc: Al Viro, Radim Krčmář,
Borislav Petkov, Tom Lendacky, linux-kernel, Joerg Roedel
On 23/02/2018 19:36, Brijesh Singh wrote:
> Using the access_ok() to validate the input before issuing the SEV
> command does not buy us anything in this case. If userland is
> giving us a garbage pointer then copy_to_user() will catch it when we try
> to return the measurement.
>
> Suggested-by: Al Viro <viro@ZenIV.linux.org.uk>
> Fixes: 0d0736f76347 (KVM: SVM: Add support for KVM_SEV_LAUNCH_MEASURE ...)
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: "Radim Krčmář" <rkrcmar@redhat.com>
> Cc: Borislav Petkov <bp@suse.de>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: linux-kernel@vger.kernel.org
> Cc: Joerg Roedel <joro@8bytes.org>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>
> We no longer need patch [1]. This patch implements Al Viro's recommendation [2]
>
> [1] https://marc.info/?l=linux-kernel&m=151905677729098&w=2.
> [2] https://marc.info/?l=linux-kernel&m=151923536116467&w=2
>
> arch/x86/kvm/svm.c | 16 +++++++---------
> 1 file changed, 7 insertions(+), 9 deletions(-)
>
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index b3e488a74828..ca69d53d7e6d 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -6236,16 +6236,18 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
>
> static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
> {
> + void __user *measure = (void __user *)(uintptr_t)argp->data;
> struct kvm_sev_info *sev = &kvm->arch.sev_info;
> struct sev_data_launch_measure *data;
> struct kvm_sev_launch_measure params;
> + void __user *p = NULL;
> void *blob = NULL;
> int ret;
>
> if (!sev_guest(kvm))
> return -ENOTTY;
>
> - if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> + if (copy_from_user(¶ms, measure, sizeof(params)))
> return -EFAULT;
>
> data = kzalloc(sizeof(*data), GFP_KERNEL);
> @@ -6256,17 +6258,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
> if (!params.len)
> goto cmd;
>
> - if (params.uaddr) {
> + p = (void __user *)(uintptr_t)params.uaddr;
> + if (p) {
> if (params.len > SEV_FW_BLOB_MAX_SIZE) {
> ret = -EINVAL;
> goto e_free;
> }
>
> - if (!access_ok(VERIFY_WRITE, params.uaddr, params.len)) {
> - ret = -EFAULT;
> - goto e_free;
> - }
> -
> ret = -ENOMEM;
> blob = kmalloc(params.len, GFP_KERNEL);
> if (!blob)
> @@ -6290,13 +6288,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
> goto e_free_blob;
>
> if (blob) {
> - if (copy_to_user((void __user *)(uintptr_t)params.uaddr, blob, params.len))
> + if (copy_to_user(p, blob, params.len))
> ret = -EFAULT;
> }
>
> done:
> params.len = data->len;
> - if (copy_to_user((void __user *)(uintptr_t)argp->data, ¶ms, sizeof(params)))
> + if (copy_to_user(measure, ¶ms, sizeof(params)))
> ret = -EFAULT;
> e_free_blob:
> kfree(blob);
>
Queued, thanks Brijesh and Al.
Paolo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-02-24 0:19 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-23 18:36 [PATCH] KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command Brijesh Singh
2018-02-24 0:19 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).