From: Joerg Roedel Date: Mon, 14 Jun 2021 13:53:27 +0000 (+0200) Subject: x86/sev: Propagate #GP if getting linear instruction address failed X-Git-Tag: v5.14-rc1~183^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=07570cef5e5c3fcec40f82a9075abb4c1da63319;p=thirdparty%2Flinux.git x86/sev: Propagate #GP if getting linear instruction address failed When an instruction is fetched from user-space, segmentation needs to be taken into account. This means that getting the linear address of an instruction can fail. Hardware would raise a #GP exception in that case, but the #VC exception handler would emulate it as a page-fault. The insn_fetch_from_user*() functions now provide the relevant information in case of a failure. Use that and propagate a #GP when the linear address of an instruction to fetch could not be calculated. Signed-off-by: Joerg Roedel Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20210614135327.9921-7-joro@8bytes.org --- diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c index a1eeaa79bf2bf..8178db07a06a6 100644 --- a/arch/x86/kernel/sev.c +++ b/arch/x86/kernel/sev.c @@ -261,11 +261,18 @@ static enum es_result __vc_decode_user_insn(struct es_em_ctxt *ctxt) int insn_bytes; insn_bytes = insn_fetch_from_user_inatomic(ctxt->regs, buffer); - if (insn_bytes <= 0) { + if (insn_bytes == 0) { + /* Nothing could be copied */ ctxt->fi.vector = X86_TRAP_PF; ctxt->fi.error_code = X86_PF_INSTR | X86_PF_USER; ctxt->fi.cr2 = ctxt->regs->ip; return ES_EXCEPTION; + } else if (insn_bytes == -EINVAL) { + /* Effective RIP could not be calculated */ + ctxt->fi.vector = X86_TRAP_GP; + ctxt->fi.error_code = 0; + ctxt->fi.cr2 = 0; + return ES_EXCEPTION; } if (!insn_decode_from_regs(&ctxt->insn, ctxt->regs, buffer, insn_bytes))