lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 10 Sep 2020 09:22:12 -0000 From: "tip-bot2 for Joerg Roedel" <tip-bot2@...utronix.de> To: linux-tip-commits@...r.kernel.org Cc: Joerg Roedel <jroedel@...e.de>, Borislav Petkov <bp@...e.de>, x86 <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org> Subject: [tip: x86/seves] x86/sev-es: Handle instruction fetches from user-space The following commit has been merged into the x86/seves branch of tip: Commit-ID: 5e3427a7bc432ed2e5de394ac30f160cc6c37a1f Gitweb: https://git.kernel.org/tip/5e3427a7bc432ed2e5de394ac30f160cc6c37a1f Author: Joerg Roedel <jroedel@...e.de> AuthorDate: Mon, 07 Sep 2020 15:15:49 +02:00 Committer: Borislav Petkov <bp@...e.de> CommitterDate: Wed, 09 Sep 2020 11:33:19 +02:00 x86/sev-es: Handle instruction fetches from user-space When a #VC exception is triggered by user-space, the instruction decoder needs to read the instruction bytes from user addresses. Enhance vc_decode_insn() to safely fetch kernel and user instructions. Signed-off-by: Joerg Roedel <jroedel@...e.de> Signed-off-by: Borislav Petkov <bp@...e.de> Link: https://lkml.kernel.org/r/20200907131613.12703-49-joro@8bytes.org --- arch/x86/kernel/sev-es.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c index b10a62a..6c30dbc 100644 --- a/arch/x86/kernel/sev-es.c +++ b/arch/x86/kernel/sev-es.c @@ -232,17 +232,30 @@ static enum es_result vc_decode_insn(struct es_em_ctxt *ctxt) enum es_result ret; int res; - res = vc_fetch_insn_kernel(ctxt, buffer); - if (unlikely(res == -EFAULT)) { - ctxt->fi.vector = X86_TRAP_PF; - ctxt->fi.error_code = 0; - ctxt->fi.cr2 = ctxt->regs->ip; - return ES_EXCEPTION; + if (user_mode(ctxt->regs)) { + res = insn_fetch_from_user(ctxt->regs, buffer); + if (!res) { + ctxt->fi.vector = X86_TRAP_PF; + ctxt->fi.error_code = X86_PF_INSTR | X86_PF_USER; + ctxt->fi.cr2 = ctxt->regs->ip; + return ES_EXCEPTION; + } + + if (!insn_decode(&ctxt->insn, ctxt->regs, buffer, res)) + return ES_DECODE_FAILED; + } else { + res = vc_fetch_insn_kernel(ctxt, buffer); + if (res) { + ctxt->fi.vector = X86_TRAP_PF; + ctxt->fi.error_code = X86_PF_INSTR; + ctxt->fi.cr2 = ctxt->regs->ip; + return ES_EXCEPTION; + } + + insn_init(&ctxt->insn, buffer, MAX_INSN_SIZE - res, 1); + insn_get_length(&ctxt->insn); } - insn_init(&ctxt->insn, buffer, MAX_INSN_SIZE - res, 1); - insn_get_length(&ctxt->insn); - ret = ctxt->insn.immediate.got ? ES_OK : ES_DECODE_FAILED; return ret;
Powered by blists - more mailing lists