From nobody Fri Apr 10 20:21:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85793C32771 for ; Fri, 19 Aug 2022 09:50:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347727AbiHSJuk (ORCPT ); Fri, 19 Aug 2022 05:50:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348215AbiHSJuW (ORCPT ); Fri, 19 Aug 2022 05:50:22 -0400 Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62427F0779 for ; Fri, 19 Aug 2022 02:50:15 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id a9so5418364lfm.12 for ; Fri, 19 Aug 2022 02:50:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc; bh=aiN/HyG19DAMmbb9E+HYWiEWCBwaM3d/0InVB5qAHRk=; b=ihVp3uzkmmR10XTCmJzBZykUjcpn6QvNZrJdy4LwjQXxGXqE48nVGTcya0+vVgtNT0 2AdCsWNh5DnHaf2otTxA83SSN/HoK0ALD4bjAZLLGyGoAHNf4ttSxCdkX6O7rZhzKCzl o1gMN4L0AHcfnZKiuEOQOnUyOXyzRhsYuICNa9tPWEC2saAMi8O8b/F9+jFdKIZKY1GM vpe3xn7g55CwWtvFFwKRjIUOq7nddHruhmZIqnFpUO9UdlJtrg/emHA0615pet04w99F 1HRFbPcSGmHlhHwFd1ZR3cOr+lN3/qErLQJQTi9pWGLnzKjzIos5auQd0/k2N0GAENOY KseA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc; bh=aiN/HyG19DAMmbb9E+HYWiEWCBwaM3d/0InVB5qAHRk=; b=izZrsBLm5m7sh8efNa+EGIGuP3xBm8KwYb17OHn3ryhCFq8R59pm6eVTlZmhTb6ezY qQKJ9tp5PX31AqSM1CiWWzbsYG804PkwXhoLFtYrVosHP6swap4qUZT81l+G51nXEAgO eI/bKhkLNx1KGdMu8en4f6nfPosX1D3d3cNFfTdoDsiJII0Vjhhvz5ftjMsoAQEV/N93 3yP5zq/DIShsZBBItS2Wp6Qq9luqj8tORYo20DVVxRmL/C5OZW+eYULvf23l95IEL/Sl HPRyTnxJDlqi6TXS4te00wnLKeBkMtE4Dstn9GjVu0apqtH8fdcrKsiLMhlU818SlSeU W4Kw== X-Gm-Message-State: ACgBeo130oUiFzg7PleNl6WCRwT3vqwY9DPynvoLwjWwt/QjEVVuH6LG TMB45K5L1xr2vihmrNQoaHP2gspY2tgm9g== X-Google-Smtp-Source: AA6agR6GKA1ewQ34KeEE0/vNCZ3FJe263bs7hBJiiJxT2uwSXGEJpuJt3+vi/zOWIofu4VneRlMd9w== X-Received: by 2002:ac2:47f1:0:b0:48a:ea6e:b8fd with SMTP id b17-20020ac247f1000000b0048aea6eb8fdmr2117418lfp.26.1660902612651; Fri, 19 Aug 2022 02:50:12 -0700 (PDT) Received: from jade.urgonet (h-79-136-84-253.A175.priv.bahnhof.se. [79.136.84.253]) by smtp.gmail.com with ESMTPSA id a8-20020a2eb548000000b00261b05d9d54sm541996ljn.127.2022.08.19.02.50.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Aug 2022 02:50:11 -0700 (PDT) From: Jens Wiklander To: linux-kernel@vger.kernel.org, op-tee@lists.trustedfirmware.org Cc: Sumit Garg , Jerome Forissier , Jens Wiklander , stable@vger.kernel.org, Nimish Mishra , Anirban Chakraborty , Debdeep Mukhopadhyay , Linus Torvalds Subject: [PATCH v3] tee: add overflow check in register_shm_helper() Date: Fri, 19 Aug 2022 11:49:52 +0200 Message-Id: <20220819094952.2602066-1-jens.wiklander@linaro.org> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region. This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference. [ 14.141620] Unable to handle kernel NULL pointer dereference at virtual = address 0000000000000010 [ 14.142556] Mem abort info: [ 14.142829] ESR =3D 0x0000000096000044 [ 14.143237] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 14.143742] SET =3D 0, FnV =3D 0 [ 14.144052] EA =3D 0, S1PTW =3D 0 [ 14.144348] FSC =3D 0x04: level 0 translation fault [ 14.144767] Data abort info: [ 14.145053] ISV =3D 0, ISS =3D 0x00000044 [ 14.145394] CM =3D 0, WnR =3D 1 [ 14.145766] user pgtable: 4k pages, 48-bit VAs, pgdp=3D000000004278e000 [ 14.146279] [0000000000000010] pgd=3D0000000000000000, p4d=3D00000000000= 00000 [ 14.147435] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 14.148026] Modules linked in: [ 14.148595] CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 [ 14.149204] Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2= 015 [ 14.149832] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 14.150481] pc : internal_get_user_pages_fast+0x474/0xa80 [ 14.151640] lr : internal_get_user_pages_fast+0x404/0xa80 [ 14.152408] sp : ffff80000a88bb30 [ 14.152711] x29: ffff80000a88bb30 x28: 0000fffff836d000 x27: 0000fffff83= 6e000 [ 14.153580] x26: fffffc0000000000 x25: fffffc0000f4a1c0 x24: ffff0000028= 9fb70 [ 14.154634] x23: ffff000002702e08 x22: 0000000000040001 x21: ffff8000097= eec60 [ 14.155378] x20: 0000000000f4a1c0 x19: 00e800007d287f43 x18: 00000000000= 00000 [ 14.156215] x17: 0000000000000000 x16: 0000000000000000 x15: 0000fffff83= 6cfb0 [ 14.157068] x14: 0000000000000000 x13: 0000000000000000 x12: 00000000000= 00000 [ 14.157747] x11: 0000000000000000 x10: 0000000000000000 x9 : 00000000000= 00000 [ 14.158576] x8 : ffff00000276ec80 x7 : 0000000000000000 x6 : 00000000000= 0003f [ 14.159243] x5 : 0000000000000000 x4 : ffff000041ec4eac x3 : ffff0000027= 74cb8 [ 14.159977] x2 : 0000000000000004 x1 : 0000000000000010 x0 : 00000000000= 00000 [ 14.160883] Call trace: [ 14.161166] internal_get_user_pages_fast+0x474/0xa80 [ 14.161763] pin_user_pages_fast+0x24/0x4c [ 14.162227] register_shm_helper+0x194/0x330 [ 14.162734] tee_shm_register_user_buf+0x78/0x120 [ 14.163290] tee_ioctl+0xd0/0x11a0 [ 14.163739] __arm64_sys_ioctl+0xa8/0xec [ 14.164227] invoke_syscall+0x48/0x114 [ 14.164653] el0_svc_common.constprop.0+0x44/0xec [ 14.165130] do_el0_svc+0x2c/0xc0 [ 14.165498] el0_svc+0x2c/0x84 [ 14.165847] el0t_64_sync_handler+0x1ac/0x1b0 [ 14.166258] el0t_64_sync+0x18c/0x190 [ 14.166878] Code: 91002318 11000401 b900f7e1 f9403be1 (f820d839) [ 14.167666] ---[ end trace 0000000000000000 ]--- Fix this by adding an overflow check when calculating the end of the memory range. Also add an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early. Fixes: 033ddf12bcf5 ("tee: add register user memory") Cc: stable@vger.kernel.org Reported-by: Nimish Mishra Reported-by: Anirban Chakraborty Reported-by: Debdeep Mukhopadhyay Suggested-by: Linus Torvalds Signed-off-by: Jens Wiklander --- v2 -> v3: - Public review - Relies entirely on access_ok() for overflow checks as suggested - Check against zero registersted pages is kept - Replaced Suggested-by tag v1 -> v2: - Non-public review - Added access_ok() and overflow check with roundup() drivers/tee/tee_shm.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index f2b1bcefcadd..a88669d6ea68 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -240,6 +240,14 @@ register_shm_helper(struct tee_context *ctx, unsigned = long addr, void *ret; int rc; =20 + addr =3D untagged_addr(addr); + start =3D rounddown(addr, PAGE_SIZE); + num_pages =3D (roundup(addr + length, PAGE_SIZE) - start) / PAGE_SIZE; + + /* Error out early if no pages are to be registered */ + if (!num_pages) + return ERR_PTR(-EINVAL); + if (!tee_device_get(teedev)) return ERR_PTR(-EINVAL); =20 @@ -261,11 +269,8 @@ register_shm_helper(struct tee_context *ctx, unsigned = long addr, shm->flags =3D flags; shm->ctx =3D ctx; shm->id =3D id; - addr =3D untagged_addr(addr); - start =3D rounddown(addr, PAGE_SIZE); shm->offset =3D addr - start; shm->size =3D length; - num_pages =3D (roundup(addr + length, PAGE_SIZE) - start) / PAGE_SIZE; shm->pages =3D kcalloc(num_pages, sizeof(*shm->pages), GFP_KERNEL); if (!shm->pages) { ret =3D ERR_PTR(-ENOMEM); @@ -326,6 +331,9 @@ struct tee_shm *tee_shm_register_user_buf(struct tee_co= ntext *ctx, void *ret; int id; =20 + if (!access_ok((void __user *)addr, length)) + return ERR_PTR(-EFAULT); + mutex_lock(&teedev->mutex); id =3D idr_alloc(&teedev->idr, NULL, 1, 0, GFP_KERNEL); mutex_unlock(&teedev->mutex); --=20 2.31.1