lkml.org 
[lkml]   [2022]   [Oct]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] x86/sgx: Add overflow check in sgx_validate_offset_length()
    sgx_validate_offset_length() function verifies "offset" and "length"
    arguments provided by userspace, but was missing an overflow check on
    their addition.
    This code was originally introduced in commit c6d26d370767 ("x86/sgx:
    Add SGX_IOC_ENCLAVE_ADD_PAGES") and later refactored in commit
    dda03e2c331b ("x86/sgx: Create utility to validate user provided offset
    and length").

    Fixes: c6d26d370767 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES")
    Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com>
    ---
    Applies on top of tip/x86/sgx ee56a283988d739c25d2d00ffb22707cb487ab47

    arch/x86/kernel/cpu/sgx/ioctl.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
    index ebe79d60619f..da8b8ea6b063 100644
    --- a/arch/x86/kernel/cpu/sgx/ioctl.c
    +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
    @@ -356,6 +356,9 @@ static int sgx_validate_offset_length(struct sgx_encl *encl,
    if (!length || !IS_ALIGNED(length, PAGE_SIZE))
    return -EINVAL;

    + if (offset + length < offset)
    + return -EINVAL;
    +
    if (offset + length - PAGE_SIZE >= encl->size)
    return -EINVAL;

    --
    2.37.3
    \
     
     \ /
      Last update: 2022-10-05 00:59    [W:3.823 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site