linux-kernel - Re: [RESEND PATCH 3/3] x86/sgx: Add xa_store_range() return value check in sgx_setup_epc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yzyx5333eIuX0zaT@kernel.org>
Date:   Wed, 5 Oct 2022 01:21:27 +0300
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Kai Huang <kai.huang@...el.com>, dave.hansen@...ux.intel.com
Cc:     linux-sgx@...r.kernel.org, tony.luck@...el.com,
        linux-kernel@...r.kernel.org, reinette.chatre@...el.com
Subject: Re: [RESEND PATCH 3/3] x86/sgx: Add xa_store_range() return value
 check in sgx_setup_epc_section()

On Tue, Oct 04, 2022 at 11:04:29AM +1300, Kai Huang wrote:
> In sgx_setup_epc_section(), xa_store_range() is called to store EPC
> pages' owner section to an Xarray using physical addresses of those EPC
> pages as index.  Currently, the return value of xa_store_range() is not
> checked, but actually it can fail (i.e. due to -ENOMEM).
> 
> Not checking the return value of xa_store_range() would result in the
> EPC section being used by SGX driver (and KVM SGX guests), but part or
> all of its EPC pages not being handled by the memory failure handling of
> EPC page.  Such inconsistency should be avoided, even at the cost that
> this section won't be used by the kernel.
> 
> Add the missing check of the return value of xa_store_range(), and when
> it fails, clean up and fail to initialize the EPC section.
> 
> Fixes: 40e0e7843e23 ("x86/sgx: Add infrastructure to identify SGX EPC pages")
> Signed-off-by: Kai Huang <kai.huang@...el.com>

Reviewed-by: Jarkko Sakkinen <jarkko@...nel.org>

This needs:

Cc: stable@...r.kernel.org # v5.17+

Dave, can you pick this independently of rest of the patch set
(unless ofc you have change suggestions)?

BR, Jarkko