crypto: ccp - Check for page allocation failure correctly in TIO

Sashiko notes:

> if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it
> safe to pass it directly to page_address()?
>
> On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might
> compute a deterministic but invalid, non-zero virtual address. The
> subsequent if (tio_status) check would then evaluate to true, and
> sev_tsm_init_locked() would dereference the invalid pointer.

Indeed, page_address(NULL) will return non-NULL garbage here. Fix this by
checking the page allocation itself for NULL, not the resulting virtual
address.

Fixes: 4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
Reported-by: Sashiko
Assisted-by: Gemini:gemini-3.1-pro-preview
Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kernel.org
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 9f3434ffba4f99cd5d855e0adf246433ecb291df..48caeffcc2172a3cd0702ff2fbf75af7e4d5a062 100644 (file)
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -1488,6 +1488,8 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
                                       &snp_panic_notifier);
 
        if (data.tio_en) {
+               struct page *page;
+
                /*
                 * This executes with the sev_cmd_mutex held so down the stack
                 * snp_reclaim_pages(locked=false) might be needed (which is extremely
@@ -1495,12 +1497,14 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
                 * Instead of exporting __snp_alloc_firmware_pages(), allocate a page
                 * for this one call here.
                 */
-               void *tio_status = page_address(__snp_alloc_firmware_pages(
-                       GFP_KERNEL_ACCOUNT | __GFP_ZERO, 0, true));
+               page = __snp_alloc_firmware_pages(GFP_KERNEL_ACCOUNT | __GFP_ZERO,
+                                                 0, true);
+               if (page) {
+                       void *tio_status = page_address(page);
 
-               if (tio_status) {
                        sev_tsm_init_locked(sev, tio_status);
-                       __snp_free_firmware_pages(virt_to_page(tio_status), 0, true);
+
+                       __snp_free_firmware_pages(page, 0, true);
                }
        }