linux-kernel - Re: [PATCH] virt: sev-guest: Satisfy linear mapping requirement in get_derived

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250813103456.GBaJxqUN9ZTqx8wXo_@fat_crate.local>
Date: Wed, 13 Aug 2025 12:34:56 +0200
From: Borislav Petkov <bp@...en8.de>
To: Tom Lendacky <thomas.lendacky@....com>
Cc: linux-kernel@...r.kernel.org, Nikunj A Dadhania <nikunj@....com>,
	Alexey Kardashevskiy <aik@....com>
Subject: Re: [PATCH] virt: sev-guest: Satisfy linear mapping requirement in
 get_derived_key()

On Wed, Jul 16, 2025 at 03:41:35PM -0500, Tom Lendacky wrote:
> @@ -149,23 +148,21 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_reque
>  	req.vmpck_id = mdesc->vmpck_id;
>  	req.req_buf = derived_key_req;
>  	req.req_sz = sizeof(*derived_key_req);
> -	req.resp_buf = buf;
> +	req.resp_buf = derived_key_resp;
>  	req.resp_sz = resp_len;
>  	req.exit_code = SVM_VMGEXIT_GUEST_REQUEST;
>  
>  	rc = snp_send_guest_request(mdesc, &req);
>  	arg->exitinfo2 = req.exitinfo2;
> -	if (rc)
> -		return rc;
> -
> -	memcpy(derived_key_resp.data, buf, sizeof(derived_key_resp.data));
> -	if (copy_to_user((void __user *)arg->resp_data, &derived_key_resp,
> -			 sizeof(derived_key_resp)))
> -		rc = -EFAULT;
> +	if (!rc) {

Why is that rc test not right after the rc assignment?

> +		if (copy_to_user((void __user *)arg->resp_data, derived_key_resp,
> +				 sizeof(derived_key_resp->data)))
> +			rc = -EFAULT;
> +	}

I see a couple of places in the driver where this is done and that exitinfo2
thing is showed in-between.

/me goes and looks

Aha, the caller looks at it and copies it to luserspace.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette