From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.6 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B4A7C433DB for ; Fri, 8 Jan 2021 02:52:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 451EE2368A for ; Fri, 8 Jan 2021 02:52:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726700AbhAHCwC (ORCPT ); Thu, 7 Jan 2021 21:52:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726482AbhAHCwC (ORCPT ); Thu, 7 Jan 2021 21:52:02 -0500 Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2BB2C0612F4 for ; Thu, 7 Jan 2021 18:51:21 -0800 (PST) Received: by mail-pf1-x449.google.com with SMTP id 15so5606310pfu.6 for ; Thu, 07 Jan 2021 18:51:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:message-id:mime-version:subject:from:to:cc; bh=igBGrAi6Rm5zuPhj7f6tM3a6FH4jJ4t835DAUEG27WY=; b=NkJg0hcph3kLiTW/09AU80ChiiYrzkV/MKO33Iako84r/B723quJq1qwiNUafzuDOc 1vYHMDLG+AGqgZi6UkYPxZHzAuRzj4ST71oWMmMm4xMR/Zfc9DTnfeNi+mayoHcncQKA 9xhwIdzrdTd5wNGA5KcXKF04SR1gaJtD/R1TCePFMrnTJy16eFXEn2BKueRCnEHXX2GA Hxx50oPqGcPBFRyV/if7ErbMYwq4W19jBC1nR4t6UxCSoiLBJpnPUmD3E8w5cA/F0o6h NrZTYFVHu9MEdmwQwrC3tfeMT+cMjs7VmHiTRrQFEsaQStJbquJZR5YT6kE/OuLpQlPm qQXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:message-id:mime-version:subject:from :to:cc; bh=igBGrAi6Rm5zuPhj7f6tM3a6FH4jJ4t835DAUEG27WY=; b=Bow7qS3aGnWp4OH0s2lOTu8YpmNliO2h5xRh3VFYfrCcKMnHuBjHgJ/q9wy6hA2IxW oqHR2IUsPH9hQnzUNtFy207kNgZMEftyktlK8IxF66OKCse+QXPv09g4kue+wZIta+j/ NfPAewKarlW/BUds9n5MT886Q5oija2SyqrWPRdSjvQ31wm1Y2i8rfMrV3BbVrLJenou KML3iNxzCTpcEKc3s12B7xXsZLSUckZumQ2NIRLz4sxUMenQdobgCDfpxgbXLCNcPtqG hdJ/dE2Do3W5EgCayj5RQ+WIQT07FXVWCAn0Qnm30xktWcnX9P7VkCNsr6RZMPkKfhql VNpg== X-Gm-Message-State: AOAM53314EvfJZNwNI/OC97sJkFq1m10bW7CgD+s2GA15bcvN6P6Qunf /cEExTQuoD9Bt3WBxqNnXoV3SZdzl7k= X-Google-Smtp-Source: ABdhPJwJ/hjL4qcB91A5Mt4uYQAf/7kFnz8+SYqM0DpYLT7O6zdyS6JzC1YkuIJ4kx5su6Y8jPmRqN2PkiQ= Sender: "baekhw via sendgmr" X-Received: from heavenly0xe8.kir.corp.google.com ([2620:0:1008:11:f693:9fff:feea:d503]) (user=baekhw job=sendgmr) by 2002:a17:902:7205:b029:db:d2d5:fe79 with SMTP id ba5-20020a1709027205b02900dbd2d5fe79mr4929950plb.30.1610074281228; Thu, 07 Jan 2021 18:51:21 -0800 (PST) Date: Thu, 7 Jan 2021 18:51:07 -0800 Message-Id: <20210108025107.1223487-1-baekhw@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.29.2.729.g45daf8777d-goog Subject: [PATCH] x86/sev-es: Fix SEV-ES #VC handler for string port IO From: "Hyunwook (Wooky) Baek" To: Thomas Gleixner , Ingo Molnar , Borislav Petkov Cc: Joerg Roedel , Tom Lendacky , David Rientjes , Sean Christopherson , linux-kernel@vger.kernel.org, x86@kernel.org, "Hyunwook (Wooky) Baek" Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Don't assume dest/source buffers are userspace addresses when manually copying data for string I/O or MOVS MMIO, as {get,put}_user() will fail if handed a kernel address and ultimately lead to a kernel panic. Signed-off-by: Hyunwook (Wooky) Baek Acked-by: David Rientjes --- arch/x86/kernel/sev-es.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c index 0bd1a0fc587e..812494d216ba 100644 --- a/arch/x86/kernel/sev-es.c +++ b/arch/x86/kernel/sev-es.c @@ -286,6 +286,12 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, u16 d2; u8 d1; + /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ + if (!user_mode(ctxt->regs) && !access_ok(s, size)) { + memcpy(dst, buf, size); + return ES_OK; + } + switch (size) { case 1: memcpy(&d1, buf, 1); @@ -335,6 +341,12 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, u16 d2; u8 d1; + /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ + if (!user_mode(ctxt->regs) && !access_ok(s, size)) { + memcpy(buf, src, size); + return ES_OK; + } + switch (size) { case 1: if (get_user(d1, s)) -- 2.29.2.729.g45daf8777d-goog