Commit e76239fe authored by Sean Christopherson's avatar Sean Christopherson Committed by Herbert Xu
Browse files

crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed 



When retrieving the PDH cert, don't attempt to copy the blobs to userspace
if the firmware command failed.  If the failure was due to an invalid
length, i.e. the userspace buffer+length was too small, copying the number
of bytes _firmware_ requires will overflow the kernel-allocated buffer and
leak data to userspace.

  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033

  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY
  Tainted: [U]=USER, [O]=OOT_MODULE
  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025
  Call Trace:
   <TASK>
   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120
   print_address_description ../mm/kasan/report.c:378 [inline]
   print_report+0xbc/0x260 ../mm/kasan/report.c:482
   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595
   check_region_inline ../mm/kasan/generic.c:-1 [inline]
   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200
   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
   copy_to_user ../include/linux/uaccess.h:236 [inline]
   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347
   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568
   vfs_ioctl ../fs/ioctl.c:51 [inline]
   __do_sys_ioctl ../fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583
   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>

WARN if the driver says the command succeeded, but the firmware error code
says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any
firwmware error.

Reported-by: default avatarAlexander Potapenko <glider@google.com>
Reported-by: default avatarSebastian Alba Vives <sebasjosue84@gmail.com>
Fixes: 76a2b524 ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent abe4a6d6

drivers/crypto/ccp/sev-dev.c

+7 −1
Original line number Diff line number Diff line
@@ -2339,7 +2339,10 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable) 


	ret = __sev_do_cmd_locked(SEV_CMD_PDH_CERT_EXPORT, &data, &argp->error);



	/* If we query the length, FW responded with expected data. */

	/*

	 * Firmware will return the length of the blobs (either the minimum

	 * required length or the actual length written), return 'em to the user.

	 */

	input.cert_chain_len = data.cert_chain_len;

	input.pdh_cert_len = data.pdh_cert_len;
@@ -2348,6 +2351,9 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable) 
		goto e_free_cert;

	}



	if (ret || WARN_ON_ONCE(argp->error))

		goto e_free_cert;



	if (pdh_blob) {

		if (copy_to_user(input_pdh_cert_address,

				 pdh_blob, input.pdh_cert_len)) {