linux-kernel - Re: [PATCH][v2] virt: tdx-guest: Don't free decrypted memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 17 Jun 2024 13:03:10 +0300
From: "kirill.shutemov@...ux.intel.com" <kirill.shutemov@...ux.intel.com>
To: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
Cc: "linux-coco@...ts.linux.dev" <linux-coco@...ts.linux.dev>, 
	"lirongqing@...du.com" <lirongqing@...du.com>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH][v2] virt: tdx-guest: Don't free decrypted memory

On Fri, Jun 14, 2024 at 04:13:46PM +0000, Edgecombe, Rick P wrote:
> On Fri, 2024-06-14 at 13:14 +0800, Li RongQing wrote:
> > In CoCo VMs it is possible for the untrusted host to cause
> > set_memory_decrypted() to fail such that an error is returned
> > and the resulting memory is shared. Callers need to take care
> > to handle these errors to avoid returning decrypted (shared)
> > memory to the page allocator, which could lead to functional
> > or security issues.
> > 
> > So when set_memory_decrypted fails, leak decrypted memory, and
> > print an error message
> > 
> > Signed-off-by: Li RongQing <lirongqing@...du.com>
> > ---
> > diff with v1: leak the page, and print error
> > 
> >  drivers/virt/coco/tdx-guest/tdx-guest.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-
> > guest/tdx-guest.c
> > index 1253bf7..3a6e76c8 100644
> > --- a/drivers/virt/coco/tdx-guest/tdx-guest.c
> > +++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
> > @@ -125,7 +125,7 @@ static void *alloc_quote_buf(void)
> >                 return NULL;
> >  
> >         if (set_memory_decrypted((unsigned long)addr, count)) {
> > -               free_pages_exact(addr, len);
> > +               pr_err("Failed to set Quote buffer decrypted, leak the
> > buffer\n");
> >                 return NULL;
> >         }
> 
> I'm not sure we need the error message, because the set_memory() failure we are
> most worried about already has a WARN.

Yeah, I think we should just remove the pr_err(). It will be shadowed by
the stack trace and WARN() anyway.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov