linux-kernel - [PATCH] x86/sev: Fix overflow when computing address for PVALIDATE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Nov 2023 20:00:19 -0600
From:   Michael Roth <michael.roth@....com>
To:     <x86@...nel.org>
CC:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H . Peter Anvin" <hpa@...or.com>,
        Tom Lendacky <thomas.lendacky@....com>,
        "Joerg Roedel" <jroedel@...e.de>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] x86/sev: Fix overflow when computing address for PVALIDATE

The GFN in the struct used for page-state change requests is a 40-bit
bit-field, so attempts to shift it by PAGE_SHIFT to get an address will
result in bits getting lost if they cross the 1TB boundary. This ends up
causing crashes when booting 1TB SNP guests with kernels that support
lazy-acceptance (without kernel-side lazy-acceptance support, OVMF
handles the PVALIDATE for GFNs in the upper address ranges, so this
overflow condition is never encountered by the kernel).

Fix this by casting the 40-bit GFN field to a 64-bit type before
converting it to an address.

Fixes: 6c3211796326 ("x86/sev: Add SNP-specific unaccepted memory support")
Signed-off-by: Michael Roth <michael.roth@....com>
---
 arch/x86/kernel/sev-shared.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/sev-shared.c b/arch/x86/kernel/sev-shared.c
index ccb0915e84e1..d92e048f4235 100644
--- a/arch/x86/kernel/sev-shared.c
+++ b/arch/x86/kernel/sev-shared.c
@@ -1083,7 +1083,7 @@ static void pvalidate_pages(struct snp_psc_desc *desc)
 	for (i = 0; i <= desc->hdr.end_entry; i++) {
 		e = &desc->entries[i];

-		vaddr = (unsigned long)pfn_to_kaddr(e->gfn);
+		vaddr = (unsigned long)pfn_to_kaddr((unsigned long)e->gfn);
 		size = e->pagesize ? RMP_PG_SIZE_2M : RMP_PG_SIZE_4K;
 		validate = e->operation == SNP_PAGE_STATE_PRIVATE;

-- 
2.25.1