All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: [bug report] nitro_enclaves: Add logic for setting an enclave vCPU
Date: Fri, 30 Oct 2020 11:30:33 +0000	[thread overview]
Message-ID: <20201030113033.GA3251003@mwanda> (raw)

Hello Andra Paraschiv,

The patch ff8a4d3e3a99: "nitro_enclaves: Add logic for setting an
enclave vCPU" from Sep 21, 2020, leads to the following static
checker warning:

	drivers/virt/nitro_enclaves/ne_misc_dev.c:471 ne_donated_cpu()
	error: passing untrusted data 'cpu' to 'cpumask_test_cpu()'

drivers/virt/nitro_enclaves/ne_misc_dev.c
  1093          switch (cmd) {
  1094          case NE_ADD_VCPU: {
  1095                  int rc = -EINVAL;
  1096                  u32 vcpu_id = 0;
  1097  
  1098                  if (copy_from_user(&vcpu_id, (void __user *)arg, sizeof(vcpu_id)))
                                           ^^^^^^^^

  1099                          return -EFAULT;
  1100  
  1101                  mutex_lock(&ne_enclave->enclave_info_mutex);
  1102  
  1103                  if (ne_enclave->state != NE_STATE_INIT) {
  1104                          dev_err_ratelimited(ne_misc_dev.this_device,
  1105                                              "Enclave is not in init state\n");
  1106  
  1107                          mutex_unlock(&ne_enclave->enclave_info_mutex);
  1108  
  1109                          return -NE_ERR_NOT_IN_INIT_STATE;
  1110                  }
  1111  
  1112                  if (vcpu_id >= (ne_enclave->nr_parent_vm_cores *
  1113                      ne_enclave->nr_threads_per_core)) {

To prevent a buffer overflow vcpu_id has to be less than "nr_cpu_ids".
Is "ne_enclave->nr_parent_vm_cores * ne_enclave->nr_threads_per_core"
<= nr_cpu_ids?  If so then it's fine.

  1114                          dev_err_ratelimited(ne_misc_dev.this_device,
  1115                                              "vCPU id higher than max CPU id\n");
  1116  
  1117                          mutex_unlock(&ne_enclave->enclave_info_mutex);
  1118  
  1119                          return -NE_ERR_INVALID_VCPU;
  1120                  }
  1121  
  1122                  if (!vcpu_id) {
  1123                          /* Use the CPU pool for choosing a CPU for the enclave. */
  1124                          rc = ne_get_cpu_from_cpu_pool(ne_enclave, &vcpu_id);
  1125                          if (rc < 0) {
  1126                                  dev_err_ratelimited(ne_misc_dev.this_device,
  1127                                                      "Error in get CPU from pool [rc=%d]\n",
  1128                                                      rc);
  1129  
  1130                                  mutex_unlock(&ne_enclave->enclave_info_mutex);
  1131  
  1132                                  return rc;
  1133                          }
  1134                  } else {
  1135                          /* Check if the provided vCPU is available in the NE CPU pool. */
  1136                          rc = ne_check_cpu_in_cpu_pool(ne_enclave, vcpu_id);
                                                                          ^^^^^^^
This will lead to the out of bounds if vcpu_id is more than
nr_cpu_ids.

  1137                          if (rc < 0) {
  1138                                  dev_err_ratelimited(ne_misc_dev.this_device,

regards,
dan carpenter

             reply	other threads:[~2020-10-30 11:30 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-30 11:30 Dan Carpenter [this message]
2020-10-30 15:23 ` [bug report] nitro_enclaves: Add logic for setting an enclave vCPU Paraschiv, Andra-Irina
2020-11-02  6:20 ` Dan Carpenter
2020-11-02  8:28 ` Paraschiv, Andra-Irina

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201030113033.GA3251003@mwanda \
    --to=dan.carpenter@oracle.com \
    --cc=kernel-janitors@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.