]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
x86/sev: Check for user-space IOIO pointing to kernel space
authorJoerg Roedel <jroedel@suse.de>
Mon, 16 Oct 2023 12:42:50 +0000 (14:42 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 25 Oct 2023 09:58:55 +0000 (11:58 +0200)
commit582f7993353c7b116651f88385b1785dffa14c5d
treeb9dcebe8719587dabb20f6e2a113ff3fa0b548ae
parent5c2c01be809db49ad744158e4c6284213da6513a
x86/sev: Check for user-space IOIO pointing to kernel space

Upstream commit: 63e44bc52047f182601e7817da969a105aa1f721

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/boot/compressed/sev.c
arch/x86/kernel/sev-shared.c