[PATCH] arch/x86: Fix size overflows in sgx_encl_create()

[PATCH] arch/x86: Fix size overflows in sgx_encl_create()

[Jarkko Sakkinen]

The total size calculated for EPC can overflow u64 given the added up page
for SECS.  Further, the total size calculated for shmem can overflow even
when the EPC size stays within limits of u64, given that it adds the extra
space for 128 byte PCMD structures (one for each page).

Address this by adding the necessary validation for each partial results
before going forward. Return -E2BIG when an overflow is detected.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-sgx/c87e01a0-e7dd-4749-a348-0980d3444f04@stanley.mountain/
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 arch/x86/kernel/cpu/sgx/ioctl.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index b65ab214bdf5..176c2d8d9b60 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -56,14 +56,26 @@ void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page *va_page)
 
 static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
 {
+	u64 epc_size, pcmd_size, shmem_size;
 	struct sgx_epc_page *secs_epc;
 	struct sgx_va_page *va_page;
 	struct sgx_pageinfo pginfo;
 	struct sgx_secinfo secinfo;
-	unsigned long encl_size;
 	struct file *backing;
 	long ret;
 
+	if ((u64)PAGE_SIZE > ~secs->size)
+		return -E2BIG;
+
+	/* The extra page is for SECS: */
+	epc_size = secs->size + PAGE_SIZE;
+	pcmd_size = epc_size >> 5;
+
+	if (pcmd_size > ~epc_size)
+		return -E2BIG;
+
+	shmem_size = epc_size + pcmd_size;
+
 	va_page = sgx_encl_grow(encl, true);
 	if (IS_ERR(va_page))
 		return PTR_ERR(va_page);
@@ -71,11 +83,7 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
 		list_add(&va_page->list, &encl->va_pages);
 	/* else the tail page of the VA page list had free slots. */
 
-	/* The extra page goes to SECS. */
-	encl_size = secs->size + PAGE_SIZE;
-
-	backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
-				   VM_NORESERVE);
+	backing = shmem_file_setup("SGX backing", shmem_size, VM_NORESERVE);
 	if (IS_ERR(backing)) {
 		ret = PTR_ERR(backing);
 		goto err_out_shrink;
-- 
2.48.1

Re: [PATCH] arch/x86: Fix size overflows in sgx_encl_create()

[Dave Hansen]

On 3/4/25 14:56, Jarkko Sakkinen wrote:
> The total size calculated for EPC can overflow u64 given the added up page
> for SECS.  Further, the total size calculated for shmem can overflow even
> when the EPC size stays within limits of u64, given that it adds the extra
> space for 128 byte PCMD structures (one for each page).
> 
> Address this by adding the necessary validation for each partial results
> before going forward. Return -E2BIG when an overflow is detected.

Wouldn't this be a lot simpler if we just had some sane limit that's
*FAR* below where u64 will overflow?

Re: [PATCH] arch/x86: Fix size overflows in sgx_encl_create()

[Jarkko Sakkinen]

On Tue, Mar 04, 2025 at 03:30:54PM -0800, Dave Hansen wrote:
> On 3/4/25 14:56, Jarkko Sakkinen wrote:
> > The total size calculated for EPC can overflow u64 given the added up page
> > for SECS.  Further, the total size calculated for shmem can overflow even
> > when the EPC size stays within limits of u64, given that it adds the extra
> > space for 128 byte PCMD structures (one for each page).
> > 
> > Address this by adding the necessary validation for each partial results
> > before going forward. Return -E2BIG when an overflow is detected.
> 
> Wouldn't this be a lot simpler if we just had some sane limit that's
> *FAR* below where u64 will overflow?

Yes, we can simply check right at the get go that the uarch requirement
of SGX is satisfied: secs->size is power of two.

BR, Jarkko