linux-kernel - [PATCH] crypto: ccp - Limit memory allocation in SEV_GET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 14 Dec 2022 12:20:46 -0800
From:   Peter Gonda <pgonda@...gle.com>
To:     herbert@...dor.apana.org.au
Cc:     Peter Gonda <pgonda@...gle.com>, Andy Nguyen <theflow@...gle.com>,
        David Rientjes <rientjes@...gle.com>, stable@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        John Allen <john.allen@....com>,
        "Thomas . Lendacky" <thomas.lendacky@....com>
Subject: [PATCH] crypto: ccp - Limit memory allocation in SEV_GET_ID2 ioctl

Currently userspace can ask for any uint32 size allocation for the
SEV_GET_ID2. Limit this allocation size to the max physically
contiguously allocation: MAX_ORDER.

Reported-by: Andy Nguyen <theflow@...gle.com>
Suggested-by: David Rientjes <rientjes@...gle.com>
Signed-off-by: Peter Gonda <pgonda@...gle.com>
Cc: stable@...r.kernel.org
Cc: Herbert Xu <herbert@...dor.apana.org.au>
Cc: linux-kernel@...r.kernel.org
Cc: linux-crypto@...r.kernel.org
Cc: John Allen <john.allen@....com>
Cc: Thomas.Lendacky <thomas.lendacky@....com>

---
 drivers/crypto/ccp/sev-dev.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 06fc7156c04f..5c16c4406764 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -878,6 +878,10 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp)
 	if (copy_from_user(&input, (void __user *)argp->data, sizeof(input)))
 		return -EFAULT;
 
+	/* Max length that can be allocated physically contiguously */
+	if (get_order(input.length) >= MAX_ORDER)
+		return -ENOMEM;
+
 	input_address = (void __user *)input.address;
 
 	if (input.address && input.length) {
-- 
2.39.0.rc1.256.g54fd8350bd-goog