From: Joerg Roedel <jroedel at suse.de>
The put_user() and get_user() functions do checks on the address which is
passed to them. They check whether the address is actually a user-space
address and whether its fine to access it. They also call might_fault()
to indicate that they could fault and possibly sleep.
All of these checks are neither wanted nor required in the #VC exception
handler, which can be invoked from almost any context and also for MMIO
instructions from kernel space on kernel memory. All the #VC handler
wants to know is whether a fault happened when the access was tried.
This is provided by __put_user()/__get_user(), which just do the access
no matter what.
Fixes: f980f9c31a92 ("x86/sev-es: Compile early handler code into kernel
image")
Cc: stable at vger.kernel.org # v5.10+
Signed-off-by: Joerg Roedel <jroedel at suse.de>
---
arch/x86/kernel/sev.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index 6530a844eb61..110b39345b40 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -342,22 +342,22 @@ static enum es_result vc_write_mem(struct es_em_ctxt
*ctxt,
switch (size) {
case 1:
memcpy(&d1, buf, 1);
- if (put_user(d1, target))
+ if (__put_user(d1, target))
goto fault;
break;
case 2:
memcpy(&d2, buf, 2);
- if (put_user(d2, target))
+ if (__put_user(d2, target))
goto fault;
break;
case 4:
memcpy(&d4, buf, 4);
- if (put_user(d4, target))
+ if (__put_user(d4, target))
goto fault;
break;
case 8:
memcpy(&d8, buf, 8);
- if (put_user(d8, target))
+ if (__put_user(d8, target))
goto fault;
break;
default:
@@ -396,22 +396,22 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt,
switch (size) {
case 1:
- if (get_user(d1, s))
+ if (__get_user(d1, s))
goto fault;
memcpy(buf, &d1, 1);
break;
case 2:
- if (get_user(d2, s))
+ if (__get_user(d2, s))
goto fault;
memcpy(buf, &d2, 2);
break;
case 4:
- if (get_user(d4, s))
+ if (__get_user(d4, s))
goto fault;
memcpy(buf, &d4, 4);
break;
case 8:
- if (get_user(d8, s))
+ if (__get_user(d8, s))
goto fault;
memcpy(buf, &d8, 8);
break;
--
2.31.1
From: Joerg> Sent: 12 May 2021 08:55 > > From: Joerg Roedel <jroedel at suse.de> > > The put_user() and get_user() functions do checks on the address which is > passed to them. They check whether the address is actually a user-space > address and whether its fine to access it. They also call might_fault() > to indicate that they could fault and possibly sleep. > > All of these checks are neither wanted nor required in the #VC exception > handler, which can be invoked from almost any context and also for MMIO > instructions from kernel space on kernel memory. All the #VC handler > wants to know is whether a fault happened when the access was tried. > > This is provided by __put_user()/__get_user(), which just do the access > no matter what.That can't be right at all. __put/get_user() are only valid on user addresses and will try to fault in a missing page - so can sleep. At best this is abused the calls. David> Fixes: f980f9c31a92 ("x86/sev-es: Compile early handler code into kernel image") > Cc: stable at vger.kernel.org # v5.10+ > Signed-off-by: Joerg Roedel <jroedel at suse.de> > --- > arch/x86/kernel/sev.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > > diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c > index 6530a844eb61..110b39345b40 100644 > --- a/arch/x86/kernel/sev.c > +++ b/arch/x86/kernel/sev.c > @@ -342,22 +342,22 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, > switch (size) { > case 1: > memcpy(&d1, buf, 1); > - if (put_user(d1, target)) > + if (__put_user(d1, target)) > goto fault; > break; > case 2: > memcpy(&d2, buf, 2); > - if (put_user(d2, target)) > + if (__put_user(d2, target)) > goto fault; > break; > case 4: > memcpy(&d4, buf, 4); > - if (put_user(d4, target)) > + if (__put_user(d4, target)) > goto fault; > break; > case 8: > memcpy(&d8, buf, 8); > - if (put_user(d8, target)) > + if (__put_user(d8, target)) > goto fault; > break; > default: > @@ -396,22 +396,22 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, > > switch (size) { > case 1: > - if (get_user(d1, s)) > + if (__get_user(d1, s)) > goto fault; > memcpy(buf, &d1, 1); > break; > case 2: > - if (get_user(d2, s)) > + if (__get_user(d2, s)) > goto fault; > memcpy(buf, &d2, 2); > break; > case 4: > - if (get_user(d4, s)) > + if (__get_user(d4, s)) > goto fault; > memcpy(buf, &d4, 4); > break; > case 8: > - if (get_user(d8, s)) > + if (__get_user(d8, s)) > goto fault; > memcpy(buf, &d8, 8); > break; > -- > 2.31.1- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
On 5/12/21 12:54 AM, Joerg Roedel wrote:> The put_user() and get_user() functions do checks on the address which is > passed to them. They check whether the address is actually a user-space > address and whether its fine to access it. They also call might_fault() > to indicate that they could fault and possibly sleep. > > All of these checks are neither wanted nor required in the #VC exception > handler, which can be invoked from almost any context and also for MMIO > instructions from kernel space on kernel memory. All the #VC handler > wants to know is whether a fault happened when the access was tried. > > This is provided by __put_user()/__get_user(), which just do the access > no matter what.The changelog _helps_, but using a "user" function to handle kernel MMIO for its error handling properties seems like it's begging for a comment. __put_user() also seems to have fun stuff like __chk_user_ptr(). It all seems sketchy to me.