arch/x86: Fix size overflows in sgx_encl_create()
Subsystems (3)
Jarkko Sakkinen
maintainerPATCH v3 1/1 arch/x86: Fix size overflows in sgx_encl_create()
The total size calculated for EPC can overflow u64 given the added up page for SECS. Further, the total size calculated for shmem can overflow even when the EPC size stays within limits of u64, given that it adds the extra space for 128 byte PCMD structures (one for each page).
Address this by pre-evaluating the micro-architectural requirement of
SGX: the address space size must be power of two. This is eventually checked up by ECREATE but the pre-check has the additional benefit of making sure that there is some space for additional data.
---
v3: Updated the commit message according to Dave's suggestion and added
fixes tag.
v2: Simply check the micro-architetural requirement in order to address
Dave's comment:
https://lore.kernel.org/linux-sgx/[email protected]/
---
arch/x86/kernel/cpu/sgx/ioctl.c | 7 +++++++
1 file changed, 7 insertions(+)arch/x86/kernel/cpu/sgx/ioctl.c +7 -0
@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)struct file *backing;long ret; +/* +* ECREATE would detect this too, but checking here also ensures +* that the 'encl_size' calculations below can never overflow. +*/ +if (!is_power_of_2 (secs->size)) +return -EINVAL ; + va_page =sgx_encl_grow (encl, true);if (IS_ERR (va_page))return PTR_ERR (va_page);
Signature · 1 line
2.48.1
[tip: x86/urgent] x86/sgx: Fix size overflows in sgx_encl_create()
The following commit has been merged into the x86/urgent branch of tip:
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 31d20f8f6c419b5e818aff2a2a0819a2a1d65003 Gitweb: https://git.kernel.org/tip/31d20f8f6c419b5e818aff2a2a0819a2a1d65003 Author: Jarkko Sakkinen <[email protected]> AuthorDate: Wed, 05 Mar 2025 07:00:05 +02:00 Committer: Ingo Molnar <[email protected]> CommitterDate: Wed, 05 Mar 2025 09:49:44 +01:00
x86/sgx: Fix size overflows in sgx_encl_create()
The total size calculated for EPC can overflow u64 given the added up page for SECS. Further, the total size calculated for shmem can overflow even when the EPC size stays within limits of u64, given that it adds the extra space for 128 byte PCMD structures (one for each page).
Address this by pre-evaluating the micro-architectural requirement of
SGX: the address space size must be power of two. This is eventually checked up by ECREATE but the pre-check has the additional benefit of making sure that there is some space for additional data.
--- arch/x86/kernel/cpu/sgx/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/x86/kernel/cpu/sgx/ioctl.c +7 -0
@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)struct file *backing;long ret; +/* +* ECREATE would detect this too, but checking here also ensures +* that the 'encl_size' calculations below can never overflow. +*/ +if (!is_power_of_2 (secs->size)) +return -EINVAL ; + va_page =sgx_encl_grow (encl, true);if (IS_ERR (va_page))return PTR_ERR (va_page);
[tip: x86/urgent] x86/sgx: Fix size overflows in sgx_encl_create()
In reply to Jarkko SakkinenThe following commit has been merged into the x86/urgent branch of tip:
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 0d3e0dfd68fb9e6b0ec865be9f3377cc3ff55733 Gitweb: https://git.kernel.org/tip/0d3e0dfd68fb9e6b0ec865be9f3377cc3ff55733 Author: Jarkko Sakkinen <[email protected]> AuthorDate: Wed, 05 Mar 2025 07:00:05 +02:00 Committer: Ingo Molnar <[email protected]> CommitterDate: Wed, 05 Mar 2025 09:51:41 +01:00
x86/sgx: Fix size overflows in sgx_encl_create()
The total size calculated for EPC can overflow u64 given the added up page for SECS. Further, the total size calculated for shmem can overflow even when the EPC size stays within limits of u64, given that it adds the extra space for 128 byte PCMD structures (one for each page).
Address this by pre-evaluating the micro-architectural requirement of
SGX: the address space size must be power of two. This is eventually checked up by ECREATE but the pre-check has the additional benefit of making sure that there is some space for additional data.
--- arch/x86/kernel/cpu/sgx/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/x86/kernel/cpu/sgx/ioctl.c +7 -0
@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)struct file *backing;long ret; +/* +* ECREATE would detect this too, but checking here also ensures +* that the 'encl_size' calculations below can never overflow. +*/ +if (!is_power_of_2 (secs->size)) +return -EINVAL ; + va_page =sgx_encl_grow (encl, true);if (IS_ERR (va_page))return PTR_ERR (va_page);