Commit 3e233385 authored by Brijesh Singh's avatar Brijesh Singh Committed by Paolo Bonzini
Browse files

KVM: SVM: no need to call access_ok() in LAUNCH_MEASURE command 



Using the access_ok() to validate the input before issuing the SEV
command does not buy us anything in this case. If userland is
giving us a garbage pointer then copy_to_user() will catch it when we try
to return the measurement.

Suggested-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Fixes: 0d0736f7 (KVM: SVM: Add support for KVM_SEV_LAUNCH_MEASURE ...)
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: linux-kernel@vger.kernel.org
Cc: Joerg Roedel <joro@8bytes.org>
Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 45d0be87

arch/x86/kvm/svm.c

+7 −9
Original line number Diff line number Diff line
@@ -6236,16 +6236,18 @@ e_free: 


static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)

{

	void __user *measure = (void __user *)(uintptr_t)argp->data;

	struct kvm_sev_info *sev = &kvm->arch.sev_info;

	struct sev_data_launch_measure *data;

	struct kvm_sev_launch_measure params;

	void __user *p = NULL;

	void *blob = NULL;

	int ret;



	if (!sev_guest(kvm))

		return -ENOTTY;



	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))

	if (copy_from_user(&params, measure, sizeof(params)))

		return -EFAULT;



	data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -6256,17 +6258,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp) 
	if (!params.len)

		goto cmd;



	if (params.uaddr) {

	p = (void __user *)(uintptr_t)params.uaddr;

	if (p) {

		if (params.len > SEV_FW_BLOB_MAX_SIZE) {

			ret = -EINVAL;

			goto e_free;

		}



		if (!access_ok(VERIFY_WRITE, params.uaddr, params.len)) {

			ret = -EFAULT;

			goto e_free;

		}



		ret = -ENOMEM;

		blob = kmalloc(params.len, GFP_KERNEL);

		if (!blob)
@@ -6290,13 +6288,13 @@ cmd: 
		goto e_free_blob;



	if (blob) {

		if (copy_to_user((void __user *)(uintptr_t)params.uaddr, blob, params.len))

		if (copy_to_user(p, blob, params.len))

			ret = -EFAULT;

	}



done:

	params.len = data->len;

	if (copy_to_user((void __user *)(uintptr_t)argp->data, &params, sizeof(params)))

	if (copy_to_user(measure, &params, sizeof(params)))

		ret = -EFAULT;

e_free_blob:

	kfree(blob);

CRA Git | Maintained and supported by SUSTech CRA and CCSE