[PATCH OLK-5.10 2/3] [Backport] x86/sev: Check IOBM for IOIO exceptions from user-space

30 Oct 2023

From: Joerg Roedel jroedel@suse.de
stable inclusion
from stable-v5.10.199
commit 5bb9ba7dafbe18e027e335f74372ca65f07f7edd
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8BCTB
CVE: CVE-2023-46813
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
Upstream commit: b9cb9c45583b911e0db71d09caa6b56469eb2bdf
Check the IO permission bitmap (if present) before emulating IOIO #VC
exceptions for user-space. These permissions are checked by hardware
already before the #VC is raised, but due to the VC-handler decoding
race it needs to be checked again in software.
Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions")
Reported-by: Tom Dohrmann erbse.13@gmx.de
Signed-off-by: Joerg Roedel jroedel@suse.de
Signed-off-by: Borislav Petkov (AMD) bp@alien8.de
Tested-by: Tom Dohrmann erbse.13@gmx.de
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
Signed-off-by: Yu Liao liaoyu15@huawei.com
---
 arch/x86/boot/compressed/sev-es.c |  5 +++++
 arch/x86/kernel/sev-es-shared.c   | 22 +++++++++++++++-------
 arch/x86/kernel/sev-es.c          | 27 +++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/arch/x86/boot/compressed/sev-es.c b/arch/x86/boot/compressed/sev-es.c
index 27826c265aab..0c2c87696d03 100644
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -106,6 +106,11 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt,
    return ES_OK;
 }
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+	return ES_OK;
+}
+
 #undef __init
 #undef __pa
 #define __init
diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c
index 82db4014deb2..ec699f113fa9 100644
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -281,6 +281,9 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt,
 static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 {
    struct insn *insn = &ctxt->insn;
+	size_t size;
+	u64 port;
+
    *exitinfo = 0;
switch (insn->opcode.bytes[0]) {
@@ -289,7 +292,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
    case 0x6d:
    	*exitinfo |= IOIO_TYPE_INS;
    	*exitinfo |= IOIO_SEG_ES;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
    	break;
/* OUTS opcodes */
@@ -297,41 +300,43 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
    case 0x6f:
    	*exitinfo |= IOIO_TYPE_OUTS;
    	*exitinfo |= IOIO_SEG_DS;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
    	break;
/* IN immediate opcodes */
    case 0xe4:
    case 0xe5:
    	*exitinfo |= IOIO_TYPE_IN;
-		*exitinfo |= (u8)insn->immediate.value << 16;
+		port	   = (u8)insn->immediate.value & 0xffff;
    	break;
/* OUT immediate opcodes */
    case 0xe6:
    case 0xe7:
    	*exitinfo |= IOIO_TYPE_OUT;
-		*exitinfo |= (u8)insn->immediate.value << 16;
+		port	   = (u8)insn->immediate.value & 0xffff;
    	break;
/* IN register opcodes */
    case 0xec:
    case 0xed:
    	*exitinfo |= IOIO_TYPE_IN;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
    	break;
/* OUT register opcodes */
    case 0xee:
    case 0xef:
    	*exitinfo |= IOIO_TYPE_OUT;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
    	break;
default:
    	return ES_DECODE_FAILED;
    }
+	*exitinfo |= port << 16;
+
    switch (insn->opcode.bytes[0]) {
    case 0x6c:
    case 0x6e:
@@ -341,12 +346,15 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
    case 0xee:
    	/* Single byte opcodes */
    	*exitinfo |= IOIO_DATA_8;
+		size       = 1;
    	break;
    default:
    	/* Length determined by instruction parsing */
    	*exitinfo |= (insn->opnd_bytes == 2) ? IOIO_DATA_16
    					     : IOIO_DATA_32;
+		size       = (insn->opnd_bytes == 2) ? 2 : 4;
    }
+
    switch (insn->addr_bytes) {
    case 2:
    	*exitinfo |= IOIO_ADDR_16;
@@ -362,7 +370,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
    if (insn_has_rep_prefix(insn))
    	*exitinfo |= IOIO_REP;
-	return ES_OK;
+	return vc_ioio_check(ctxt, (u16)port, size);
 }
static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c
index 23126bbd85c4..9a86f43393ce 100644
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -448,6 +448,33 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt
    return ES_OK;
 }
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+	BUG_ON(size > 4);
+
+	if (user_mode(ctxt->regs)) {
+		struct thread_struct *t = &current->thread;
+		struct io_bitmap *iobm = t->io_bitmap;
+		size_t idx;
+
+		if (!iobm)
+			goto fault;
+
+		for (idx = port; idx < port + size; ++idx) {
+			if (test_bit(idx, iobm->bitmap))
+				goto fault;
+		}
+	}
+
+	return ES_OK;
+
+fault:
+	ctxt->fi.vector = X86_TRAP_GP;
+	ctxt->fi.error_code = 0;
+
+	return ES_EXCEPTION;
+}
+
 /* Include code shared with pre-decompression boot stage */
 #include "sev-es-shared.c"
-- 
2.25.1


    

2024

2023

2022

2021

2020

2019

[PATCH OLK-5.10 2/3] [Backport] x86/sev: Check IOBM for IOIO exceptions from user-space