Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | Date | Tue, 10 Jan 2023 10:32:08 -0600 | Subject | Re: [PATCH] KVM: sev: Fix int overflow in send|recieve_update_data ioctls | From | Tom Lendacky <> |
| |
On 1/9/23 10:08, Peter Gonda wrote: > KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer > overflow issue. Params.guest_len and offset are both 32bite wide, with a > large params.guest_len the check to confirm a page boundary is not > crossed can falsely pass: > > /* Check if we are crossing the page boundary * > offset = params.guest_uaddr & (PAGE_SIZE - 1); > if ((params.guest_len + offset > PAGE_SIZE)) > > Add an additional check to this conditional to confirm that > params.guest_len itself is not greater than PAGE_SIZE. > > The current code is can only overflow with a params.guest_len of greater > than 0xfffff000. And the FW spec says these commands fail with lengths > greater than 16KB. So this issue should not be a security concern > > Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") > Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") > Reported-by: Andy Nguyen <theflow@google.com> > Suggested-by: Thomas Lendacky <thomas.lendacky@amd.com> > Signed-off-by: Peter Gonda <pgonda@google.com> > Cc: David Rientjes <rientjes@google.com> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Sean Christopherson <seanjc@google.com> > Cc: kvm@vger.kernel.org > Cc: stable@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > --- > arch/x86/kvm/svm/sev.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 273cba809328..9451de72f917 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -1294,7 +1294,7 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) > > /* Check if we are crossing the page boundary */ > offset = params.guest_uaddr & (PAGE_SIZE - 1); > - if ((params.guest_len + offset > PAGE_SIZE)) > + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset > PAGE_SIZE))
I see the original if statement had double parentheses, which looks strange. Should this if (and the one below) be:
if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE)
Thanks, Tom
> return -EINVAL; > > /* Pin guest memory */ > @@ -1474,7 +1474,7 @@ static int sev_receive_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) > > /* Check if we are crossing the page boundary */ > offset = params.guest_uaddr & (PAGE_SIZE - 1); > - if ((params.guest_len + offset > PAGE_SIZE)) > + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset > PAGE_SIZE)) > return -EINVAL; > > hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);
| ![\](/images/icornerr.gif) |