Re: [PATCH 6.6.y] x86/tdx: Fix "in-kernel MMIO" check

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Oct 02, 2024 at 02:23:59PM +0200, Alexey Gladkov (Intel) wrote:
> TDX only supports kernel-initiated MMIO operations. The handle_mmio()
> function checks if the #VE exception occurred in the kernel and rejects
> the operation if it did not.
> 
> However, userspace can deceive the kernel into performing MMIO on its
> behalf. For example, if userspace can point a syscall to an MMIO address,
> syscall does get_user() or put_user() on it, triggering MMIO #VE. The
> kernel will treat the #VE as in-kernel MMIO.
> 
> Ensure that the target MMIO address is within the kernel before decoding
> instruction.
> 
> Fixes: 31d58c4e557d ("x86/tdx: Handle in-kernel MMIO")
> Signed-off-by: Alexey Gladkov (Intel) <legion@kernel.org>
> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
> Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
> Cc:stable@vger.kernel.org
> Link: https://lore.kernel.org/all/565a804b80387970460a4ebc67c88d1380f61ad1.1726237595.git.legion%40kernel.org
> (cherry picked from commit d4fc4d01471528da8a9797a065982e05090e1d81)
> Signed-off-by: Alexey Gladkov (Intel) <legion@kernel.org>
> ---
>  arch/x86/coco/tdx/tdx.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 

Now queued up, thanks.

greg k-h