From nobody Sat Feb 7 22:07:58 2026 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2059.outbound.protection.outlook.com [40.107.237.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DAE66BB5B; Fri, 7 Mar 2025 01:37:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.237.59 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741311475; cv=fail; b=prGjn7+P/PTzdyfmTogbXiBNVmvhaT/bIurSK/uzkPJed1zw+iind0PyFeRMGbpch4Xh0jHZrO7g/yKfDkCbwwhRJReFgX/kvvLoFDo0kgrcKpGZbkk0T2+bsirvD83x6/EBF3frRaURVGQ/DZCWOc3hvsO42MLU5hiIBpW8vLQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741311475; c=relaxed/simple; bh=RquRjK7P/tEtVjiSAgomrt8rWbCR6y4/9Fu2Sk3ZpSg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bXu/fOw9Ze3chQsrCS2FzzQOtmihi8lD17OBAR4HrgwfzeswrfAGO0m/cpT0SImhFfrH0LPzpyKFu8uLyGlkzQnpO1EW/f4r4ofBR07a10tPtqJxcdXBojTaMxs1RnV2CJPiTcZYvYhu0t4D5h3bvribW9NQ52z2yV4V0SAutEs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=pji9CmSn; arc=fail smtp.client-ip=40.107.237.59 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="pji9CmSn" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MhNK3DF4Wv4f24R4Or/FTZxor5EDKmoYYlhgGSO1SaMZnghfeH5WvoI+LEmIOZW/6YAYnxRVs2VQTC4QaYhvvQDsKBO/e1uXqI9MDn41eNF4NQOydb9KGYrzWIjLdd+VSkJsCvuxMtr+PNkOpYVeOdLom/3bgRQoJIxNinN7Cx57s3W0yboD1XdXsBcvJEn/yy/WZmCDFj18Y1aqPkiaMMaOn/CPjvjVTBjh4gIpx4p0weKufY33xlV5el9VEDYO90ks+xjWSG9CvUNzqljPSbMmf+XbyQYvIWDU61+RphQ4r8UpG0EsWusO3yB4UiWIOpfVO/FcbOBhWBgXqi4NzA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hOIfJhfX3mdR5A0gXzFBpu9OxA1L4tXhUL3eMX5fK60=; b=mAIbWw61RxiYhFRG2lHRJTZARoZ5CbXoqENZlq6ZcvT7MRciU2H3bc1lG75Pv+dySnDDxT5gvY1PlSIKRMTQcsLbzKNlOmNDWns8s+jfhLs75+PE9uU+rLsNZa0d9j9exg0joA9j+Au0O2ar7nUbkYHHVX2UUpxrnP2gcXCHf0XnZ6UkniJtaIdGRhCIsvORrqn3Vs1+5OoeYBXwG5iQjF+2Q/IFXOxZVP6HX7U/TIh0B9lbChrvoDhjMq4xjb2KpZyYJj8qI3v69RPPSEmv4GtKeURcD16jzmjSFBIY4y072HYQRNMIBdnvGA5MEJrmO+cYMf21pYEgPugKiVEcDQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hOIfJhfX3mdR5A0gXzFBpu9OxA1L4tXhUL3eMX5fK60=; b=pji9CmSn7nwa1j07LqozwNjqp2jxf/IJunARb+0R49k/nkND8ugrJTkSI/yPYr6voeQNsAhJgzb2XkQnba+S+JlPvwlUJeA7q8uI+QnkU1hLUSyfKZoVpBP0qD7Xm+MvtMp5TmYWbxR8fG0vocEAAj9mjfBzTS5YJIGVKP0k14E= Received: from MW4PR03CA0009.namprd03.prod.outlook.com (2603:10b6:303:8f::14) by CY5PR12MB6347.namprd12.prod.outlook.com (2603:10b6:930:20::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8511.22; Fri, 7 Mar 2025 01:37:49 +0000 Received: from SJ1PEPF00001CDF.namprd05.prod.outlook.com (2603:10b6:303:8f:cafe::8a) by MW4PR03CA0009.outlook.office365.com (2603:10b6:303:8f::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8511.19 via Frontend Transport; Fri, 7 Mar 2025 01:37:48 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by SJ1PEPF00001CDF.mail.protection.outlook.com (10.167.242.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.8511.15 via Frontend Transport; Fri, 7 Mar 2025 01:37:48 +0000 Received: from aiemdee.l.aik.id.au (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.39; Thu, 6 Mar 2025 19:37:43 -0600 From: Alexey Kardashevskiy To: CC: , Thomas Gleixner , "Ingo Molnar" , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Tom Lendacky , Nikunj A Dadhania , Ard Biesheuvel , Pavan Kumar Paluri , Ashish Kalra , Paolo Bonzini , Michael Roth , Kevin Loughlin , "Kuppuswamy Sathyanarayanan" , Brijesh Singh , Liam Merwick , "Alexey Kardashevskiy" , , Subject: [PATCH 1/2] virt: sev-guest: Allocate request data dynamically Date: Fri, 7 Mar 2025 12:36:59 +1100 Message-ID: <20250307013700.437505-2-aik@amd.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250307013700.437505-1-aik@amd.com> References: <20250307013700.437505-1-aik@amd.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF00001CDF:EE_|CY5PR12MB6347:EE_ X-MS-Office365-Filtering-Correlation-Id: 02455609-68f9-4bbf-8fcd-08dd5d18ab2e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|36860700013|376014|7416014|13003099007; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?fBGFb1oTBem4+1VhHTCxzLU0lN2VusEGvQr2yFvBgbqTR8kCWHNSDLfHnZol?= =?us-ascii?Q?dQlwiJBb7cbChRrqUA4jCK7RVKB60HQOMq7hbmJTcGLJZOsn4xsgWukFkXsR?= =?us-ascii?Q?tYsO7/3QvdafZixot5N1Jq8SJFalCJeoYreHJewgbSIRHvl65iaPIyWxW9Jv?= =?us-ascii?Q?zw4itdSDfXRVz2OsdxzYlFvl+JDUSK/Sr1MQJjhN9kQAoPUTznlA79VPVvcN?= =?us-ascii?Q?5fJC2eLD+FwSXd51E6epIvn8LYQUq6gQMUWeKVbuXUuWMs7IZM65YUD6S2Wk?= =?us-ascii?Q?1HrzgndHu58W+2kJxSdy+DUL+3xmUwII8MKymeItyJMXXWwJWLrKXfIbzST8?= =?us-ascii?Q?Zl79cPlpUlr7SC6hjSPuCvoPpm6FcZrgeJYzX3xCPAkbanCSLQLe93yR0B/y?= =?us-ascii?Q?optJpFcfd3KFIRdUmeOP9a5FSC+l4CyRf+4vZV/FJdoTYwdkAaAhl2n9KwtC?= =?us-ascii?Q?9GpFVkTHjuI/TwA3wsNwuuI4TdiWRkGN6NoHu9NwK8DcWwlEaUYHjJMMD07B?= =?us-ascii?Q?p/e9ZlrfYxDtAp6B1OxGQmVUWVK5Kr0wP1byfjju8EbPGQIwyHNPnNLzL9md?= =?us-ascii?Q?EFZedSxCgvEOaIBzjCEI8CFYIvCEu3/nCmjghC+fo/+3fogwmhU4boQvaiIn?= =?us-ascii?Q?ATaB2VrqSLdEtwndRN70dOeCzIwaulxeT4EWskQbsa+0FPB3Gdpw7CF1X3hB?= =?us-ascii?Q?reh+0cej9AhC71c9kPsdhY2Dt+wkTwvcSeKvQ0r9I428cDV7rk66rREc577i?= =?us-ascii?Q?E5okuYvOC218c8cLXzuKm2rSJVA0tzh9da4aMb7Mhm5k8O8UxPlREW5bgJfb?= =?us-ascii?Q?e9DRAu3SN1DTVsrF5r5bPByHWHWRNUuwOdy6HcMwP0L2sZtSff8onFjBZQ/+?= =?us-ascii?Q?2zNU2e2o0aXTprtc9PR2SbB6ZFbLGRUZ4T5Kblv20VZpDQe7WTzEP4NpQHW/?= =?us-ascii?Q?4zwN6NRGnApSjE62pdUs6GA7awTDEIioRnTQuywX74jhGMDJfWaM2xTfO5WO?= =?us-ascii?Q?ZPLNt/bSH81U/EaH41DeusOH82yuJS8KlskKnJTwb55WJWoaDERTs++TyqXM?= =?us-ascii?Q?ANTzOWHY4qblGNf+PbVXALra5upleaVwRJCeCyTwJ8YaeM7BZlZiLea2NmVm?= =?us-ascii?Q?g58gCUkmZtQnuU4vYRTQPaJNU1g1CzAYIyzWFKzDPA+LVqaixAKNbgTOWGu4?= =?us-ascii?Q?W7b+5cBoh3hdimVMPgyOsRD4Ir9QA+/2R5MSuAOGHbJSC8bfGdWoCaSef5bW?= =?us-ascii?Q?GWvoz2J5RwTbF4IJArRSDQYMWqEAbPlu2MjwJE6+IjZX85NZHH3oGwxU9E70?= =?us-ascii?Q?iXzMX507DV4ceKuGuxHX9U2I5ySkTwCfGp8H/iqtxZHTXnlAc9qOrksqaqcX?= =?us-ascii?Q?86t8WNyS1U/4SkWLVKXt3sk74f5O0MPL0K9eEl2DUQMgeK4sNH3xXBITa6WD?= =?us-ascii?Q?sza0qF40NjRI+UE+k3L5+swHbnZETEGQLjfkAGFg8iyy006V4+pGQsS9cf3g?= =?us-ascii?Q?O6bjTzxApIHUR/U=3D?= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(36860700013)(376014)(7416014)(13003099007);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2025 01:37:48.7313 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 02455609-68f9-4bbf-8fcd-08dd5d18ab2e X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00001CDF.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6347 Content-Type: text/plain; charset="utf-8" From: Nikunj A Dadhania Commit ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mutex") narrowed the command mutex scope to snp_send_guest_request. However, GET_REPORT, GET_DERIVED_KEY, and GET_EXT_REPORT share the req structure in snp_guest_dev. Without the mutex protection, concurrent requests can overwrite each other's data. Fix it by dynamically allocating the request structure. Fixes: ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mute= x") Cc: stable@vger.kernel.org Reported-by: andreas.stuehrk@yaxi.tech Closes: https://github.com/AMDESE/AMDSEV/issues/265 Signed-off-by: Nikunj A Dadhania --- drivers/virt/coco/sev-guest/sev-guest.c | 24 ++++++++++++-------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/se= v-guest/sev-guest.c index ddec5677e247..4699fdc9ed44 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -39,12 +39,6 @@ struct snp_guest_dev { struct miscdevice misc; =20 struct snp_msg_desc *msg_desc; - - union { - struct snp_report_req report; - struct snp_derived_key_req derived_key; - struct snp_ext_report_req ext_report; - } req; }; =20 /* @@ -72,7 +66,7 @@ struct snp_req_resp { =20 static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_requ= est_ioctl *arg) { - struct snp_report_req *report_req =3D &snp_dev->req.report; + struct snp_report_req *report_req __free(kfree) =3D NULL; struct snp_msg_desc *mdesc =3D snp_dev->msg_desc; struct snp_report_resp *report_resp; struct snp_guest_req req =3D {}; @@ -81,6 +75,10 @@ static int get_report(struct snp_guest_dev *snp_dev, str= uct snp_guest_request_io if (!arg->req_data || !arg->resp_data) return -EINVAL; =20 + report_req =3D kzalloc(sizeof(*report_req), GFP_KERNEL_ACCOUNT); + if (!report_req) + return -ENOMEM; + if (copy_from_user(report_req, (void __user *)arg->req_data, sizeof(*repo= rt_req))) return -EFAULT; =20 @@ -117,7 +115,7 @@ static int get_report(struct snp_guest_dev *snp_dev, st= ruct snp_guest_request_io =20 static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest= _request_ioctl *arg) { - struct snp_derived_key_req *derived_key_req =3D &snp_dev->req.derived_key; + struct snp_derived_key_req *derived_key_req __free(kfree) =3D NULL; struct snp_derived_key_resp derived_key_resp =3D {0}; struct snp_msg_desc *mdesc =3D snp_dev->msg_desc; struct snp_guest_req req =3D {}; @@ -137,6 +135,10 @@ static int get_derived_key(struct snp_guest_dev *snp_d= ev, struct snp_guest_reque if (sizeof(buf) < resp_len) return -ENOMEM; =20 + derived_key_req =3D kzalloc(sizeof(*derived_key_req), GFP_KERNEL_ACCOUNT); + if (!derived_key_req) + return -ENOMEM; + if (copy_from_user(derived_key_req, (void __user *)arg->req_data, sizeof(*derived_key_req))) return -EFAULT; @@ -169,7 +171,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev= , struct snp_guest_reques struct snp_req_resp *io) =20 { - struct snp_ext_report_req *report_req =3D &snp_dev->req.ext_report; + struct snp_ext_report_req *report_req __free(kfree) =3D NULL; struct snp_msg_desc *mdesc =3D snp_dev->msg_desc; struct snp_report_resp *report_resp; struct snp_guest_req req =3D {}; @@ -179,6 +181,10 @@ static int get_ext_report(struct snp_guest_dev *snp_de= v, struct snp_guest_reques if (sockptr_is_null(io->req_data) || sockptr_is_null(io->resp_data)) return -EINVAL; =20 + report_req =3D kzalloc(sizeof(*report_req), GFP_KERNEL_ACCOUNT); + if (!report_req) + return -ENOMEM; + if (copy_from_sockptr(report_req, io->req_data, sizeof(*report_req))) return -EFAULT; =20 --=20 2.47.1 From nobody Sat Feb 7 22:07:58 2026 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (mail-dm6nam11on2084.outbound.protection.outlook.com [40.107.223.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86D7A1474DA; Fri, 7 Mar 2025 01:38:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.223.84 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741311497; cv=fail; b=cmMN7Dvlvyea6xd/dzH2Ho+K+buxOhDtMZ1pHw3RtTwt1WaGfR5MLaeXwQD2xK7B+HZC+ltdQec+oFYXuM3nBYAHmbNihr6WrTZlzsxpQpf3kFlw8jEm9MYbyAiG1BLxLL9zJjd3MI+TW/y4AoZU53F+JfCUcvXE53A18NoG1Oo= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741311497; c=relaxed/simple; bh=THeFKvp3j0L6RC4JPhbny5m6BTqf8iMceanexdwcbCM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=M2r7JCgfCHfNZgIJid16ihHgC5knrjrra2bCysEREnGAArp2ox5CE2Kb+KEty+rrEtdR862t64pX7lkk3+bkMLTz8AWmL947PUPVEI6JtPL8JrOEuPCocGo7f322gVWXDIcXYgC7UMBeYMd/6zCyZ6iVX901TBhOnlYZ+4XF9oQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=Xj5zEFVd; arc=fail smtp.client-ip=40.107.223.84 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="Xj5zEFVd" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NU/B/M2npBelAnuWITU3uE/ngtfD3BIgoJCAB+rJTffDhhpR/Wj4r+3LZbvXHVFvFOuD6UfuSxfCClshIgD4JX1NrPGFVK49BW5WbxyaKWS6s+naNaNyZHYdSRzYJt5bQDRRLxDoqWE8MzgzG2J9nfxwtYl+jf3XsvVTbXhls+NeglIWwFIw8UvQsqyeHdzGCIWANk0AikP9cIGi8JwkC1qzwYQDQ4s0YzG6ml39mzR1Z6roj7FU0Jk7ovxChBbUqxLdtbp5w1g6pen882bMT1J2hJenhcotn32y+PEGGtrWqrqbFVHDo24KjFoL4QdUgK8UIUCPUguiUMXYRV5KGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=32janF29oiGx1bXQmQwhwfMV5OrSN1teXucjdVaVFkQ=; b=TB+EzkphtsEbEmqgLGf2+wShBiP5gpPwsuMm+RVqgZPk/v1aCHFxX18vPRhOez5aAFS9nvsS2WzpEDmk9gifuOGGC8Jn084zcZiSZnNFY2IxxahljHaSljN9LF4dZmr2d0/OTz0gpTK6p2nU8VzPYANa6kXIYxqX8WIBXX9yhui954nNSgy+MtLkMf7w1I8i1+F6sDIqoJPGUQtHt2fvMR9voLXuvJekDYLWhWqjAnM4rLsSuTYczzDlolx6eA9ZcAZ7HKT6jFHKHYb8eVQ8iV/FZ9s0q1hJXwz4buYoG592jcKTTVRoJn5LspM5WDwm93MrsI10grH0cOIwODPhuA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=32janF29oiGx1bXQmQwhwfMV5OrSN1teXucjdVaVFkQ=; b=Xj5zEFVdkKh235Qk/FP/GZQQrCY5LXyBkUIK3CrtsTANFHsKzMNIK7LfMO932pxN/m/bR3IuidKfWVQ5Emtvth6YE6FE7Ntr6k1KrYE00p/Q+OyC6y5dPxbW+QqqcMCj3uRR1J7YI2dXEjoiC6MCB91Qj+9bfnGswyPUbJSHZdU= Received: from MW2PR16CA0030.namprd16.prod.outlook.com (2603:10b6:907::43) by DM6PR12MB4451.namprd12.prod.outlook.com (2603:10b6:5:2ab::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8511.19; Fri, 7 Mar 2025 01:38:07 +0000 Received: from SJ1PEPF00001CDE.namprd05.prod.outlook.com (2603:10b6:907:0:cafe::50) by MW2PR16CA0030.outlook.office365.com (2603:10b6:907::43) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8511.18 via Frontend Transport; Fri, 7 Mar 2025 01:38:07 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by SJ1PEPF00001CDE.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.8511.15 via Frontend Transport; Fri, 7 Mar 2025 01:38:06 +0000 Received: from aiemdee.l.aik.id.au (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.39; Thu, 6 Mar 2025 19:38:00 -0600 From: Alexey Kardashevskiy To: CC: , Thomas Gleixner , "Ingo Molnar" , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Tom Lendacky , Nikunj A Dadhania , Ard Biesheuvel , Pavan Kumar Paluri , Ashish Kalra , Paolo Bonzini , Michael Roth , Kevin Loughlin , "Kuppuswamy Sathyanarayanan" , Brijesh Singh , Liam Merwick , "Alexey Kardashevskiy" , Subject: [PATCH 2/2] virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex Date: Fri, 7 Mar 2025 12:37:00 +1100 Message-ID: <20250307013700.437505-3-aik@amd.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250307013700.437505-1-aik@amd.com> References: <20250307013700.437505-1-aik@amd.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF00001CDE:EE_|DM6PR12MB4451:EE_ X-MS-Office365-Filtering-Correlation-Id: d12e4289-2a72-42ad-9d33-08dd5d18b606 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|36860700013|82310400026|7416014|376014; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?Q3emFl5b20olSe9h0yhO4MQ3Oal1Ygu0kSBfEoRS6sHfkzjfn23C4ATp99m9?= =?us-ascii?Q?qS0RbTG3GfKroI0436O+HqZmRhEpcp5ya+P62oXUfVodMYm23gCEtIxhZGYk?= =?us-ascii?Q?3lIBjHDgHuSQ/azmT3WiKnoEZlacrtNs8Q/nguqBYvAsQzFrOAHzQVjTbuL0?= =?us-ascii?Q?FlOJxNXUGEuKHQwnnT/eAwT5X3GXR5mvtB7qbx0fQWoZF2Gwe+nYHiLGX7Jg?= =?us-ascii?Q?08NH2gpMTHxz9U1fPcKwzUtcZnNV4kwe1xJdPGYgqE/kVxqAX7zuIPWGFNlR?= =?us-ascii?Q?Tb7LburQ+0JAfOMTMlKcPzQjDdfNFg3PzirONQA3HmbLxgq/eRmCBXqWtgnr?= =?us-ascii?Q?eIRoTWNp67UpgCEmoaire/Qn1qpuTJrQPYcRYdCo9J58IQ8J5JIaPa7XhlOO?= =?us-ascii?Q?Llppimqd7snMd5fta3AEKlm8hzFGXvduxPdmjEIBWIMbwCO5KgesF8x/2EC+?= =?us-ascii?Q?Q0RdtinUcuymFaxaU1ryDFTTowq89N8pYN7zuQY46C0nw8fuhcIGXt2OQ/YM?= =?us-ascii?Q?wQyTnV1oU849QZCkniKMzsAx7ymDGxP1V4o49ErrnKn+EagMPirlOlBdN/jl?= =?us-ascii?Q?riyv3PW1uAGydvItmHKCO+EGGwQEDXRuzPbojDdWBZBYS0m5+vDCUCdS6IsL?= =?us-ascii?Q?7dF7GBvelVy3RMpdsKkJmwJWf1PUwu4/Ig649kcNO33ZxSCuXlVarvLDqInt?= =?us-ascii?Q?vM3v2c+8JXql2oJFj0upjvrvBQt8dlg39LVL6KZHfPON/uSKe+SgR9RFsSws?= =?us-ascii?Q?yq/wQA8SC3V+OnDvcq2KDXBbUV9lJ95GGrKo86uTvvKPaS1Bt89NscPxkmbx?= =?us-ascii?Q?UDCwGNx/0y0W+yAJXZiz7gon8kCCpzQIn545OMdESxUcLsF8iXYfBrz+avY3?= =?us-ascii?Q?qeSkIT+7LRCUkuL1KXJXMDnJedHcODM22mcBmBoozUPL+3Y9zE9cW3wjIPyK?= =?us-ascii?Q?YZ7PCuVJucCdtQaQoIwE9DHgLVpqvwnVHecLW0k2HtjnuY/msCZrUuaeyPHG?= =?us-ascii?Q?efnCyUTC/GMVec/WGS9ebH0BbapReTyBqMXlYO4fveK0Y3ZoprOQYLiEro5W?= =?us-ascii?Q?rARGPPah5iQQFxfPeuCYSC8RfSS+5iMPKXSw80BmxRmQR708jh1lJ4YkUxJl?= =?us-ascii?Q?UkaIjYCDeLpof03yllEUWrD6OO4w33cpGXiuuQ+ZTgm6wpzxg98SHD2Aq30p?= =?us-ascii?Q?BJ3SkmSqkDb2uwVk4ULiLS7jeO1I77A3PkDy52OXambwv+G6nlx8AjJyqUsQ?= =?us-ascii?Q?k4hVkXXJaO0MZ36jmQ5vohKLU4D9un3oSR3rBlMaZ4XLZZIDSXMzHH6wGfTr?= =?us-ascii?Q?eYCdmXHYsjkqvvPZuo9aev1OAAk2IzDSo8KFiloDJc0JUUgZYKQvnFu3bJIw?= =?us-ascii?Q?eEp/+QWEB3NG5oTPa2TIKG7LJ3TmgrtqoJlAPwTHAPRuD8ov14oz7psD+Vv0?= =?us-ascii?Q?Fv2rkE7B0CGniuyK54rTik6mUBZA/axUmNgy65onhq3rG2tLs4gH0pS7r5aY?= =?us-ascii?Q?AOP1N8pEFA1kpzs=3D?= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(1800799024)(36860700013)(82310400026)(7416014)(376014);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2025 01:38:06.9400 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d12e4289-2a72-42ad-9d33-08dd5d18b606 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00001CDE.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4451 Content-Type: text/plain; charset="utf-8" Compared to the SNP Guest Request, the "Extended" version adds data pages for receiving certificates. If not enough pages provided, the HV can report to the VM how much is needed so the VM can reallocate and repeat. Commit ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mutex") moved handling of the allocated/desired pages number out of scope of said mutex and create a possibility for a race (multiple instances trying to trigger Extended request in a VM) as there is just one instance of snp_msg_desc per /dev/sev-guest and no locking other than snp_cmd_mutex. Fix the issue by moving the data blob/size and the GHCB input struct (snp_req_data) into snp_guest_req which is allocated on stack now and accessed by the GHCB caller under that mutex. Stop allocating SEV_FW_BLOB_MAX_SIZE in snp_msg_alloc() as only one of four callers needs it. Free the received blob in get_ext_report() right after it is copied to the userspace. Possible future users of snp_send_guest_request() are likely to have different ideas about the buffer size anyways. Fixes: ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mute= x") Cc: stable@vger.kernel.org Cc: Nikunj A Dadhania Signed-off-by: Alexey Kardashevskiy Reviewed-by: Nikunj A Dadhania --- arch/x86/include/asm/sev.h | 6 ++-- arch/x86/coco/sev/core.c | 23 +++++-------- drivers/virt/coco/sev-guest/sev-guest.c | 34 ++++++++++++++++---- 3 files changed, 39 insertions(+), 24 deletions(-) diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 1581246491b5..ba7999f66abe 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -203,6 +203,9 @@ struct snp_guest_req { unsigned int vmpck_id; u8 msg_version; u8 msg_type; + + struct snp_req_data input; + void *certs_data; }; =20 /* @@ -263,9 +266,6 @@ struct snp_msg_desc { struct snp_guest_msg secret_request, secret_response; =20 struct snp_secrets_page *secrets; - struct snp_req_data input; - - void *certs_data; =20 struct aesgcm_ctx *ctx; =20 diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index 82492efc5d94..d02eea5e3d50 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -2853,19 +2853,8 @@ struct snp_msg_desc *snp_msg_alloc(void) if (!mdesc->response) goto e_free_request; =20 - mdesc->certs_data =3D alloc_shared_pages(SEV_FW_BLOB_MAX_SIZE); - if (!mdesc->certs_data) - goto e_free_response; - - /* initial the input address for guest request */ - mdesc->input.req_gpa =3D __pa(mdesc->request); - mdesc->input.resp_gpa =3D __pa(mdesc->response); - mdesc->input.data_gpa =3D __pa(mdesc->certs_data); - return mdesc; =20 -e_free_response: - free_shared_pages(mdesc->response, sizeof(struct snp_guest_msg)); e_free_request: free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); e_unmap: @@ -2885,7 +2874,6 @@ void snp_msg_free(struct snp_msg_desc *mdesc) kfree(mdesc->ctx); free_shared_pages(mdesc->response, sizeof(struct snp_guest_msg)); free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); - free_shared_pages(mdesc->certs_data, SEV_FW_BLOB_MAX_SIZE); iounmap((__force void __iomem *)mdesc->secrets); =20 memset(mdesc, 0, sizeof(*mdesc)); @@ -3054,7 +3042,7 @@ static int __handle_guest_request(struct snp_msg_desc= *mdesc, struct snp_guest_r * sequence number must be incremented or the VMPCK must be deleted to * prevent reuse of the IV. */ - rc =3D snp_issue_guest_request(req, &mdesc->input, rio); + rc =3D snp_issue_guest_request(req, &req->input, rio); switch (rc) { case -ENOSPC: /* @@ -3064,7 +3052,7 @@ static int __handle_guest_request(struct snp_msg_desc= *mdesc, struct snp_guest_r * order to increment the sequence number and thus avoid * IV reuse. */ - override_npages =3D mdesc->input.data_npages; + override_npages =3D req->input.data_npages; req->exit_code =3D SVM_VMGEXIT_GUEST_REQUEST; =20 /* @@ -3120,7 +3108,7 @@ static int __handle_guest_request(struct snp_msg_desc= *mdesc, struct snp_guest_r } =20 if (override_npages) - mdesc->input.data_npages =3D override_npages; + req->input.data_npages =3D override_npages; =20 return rc; } @@ -3158,6 +3146,11 @@ int snp_send_guest_request(struct snp_msg_desc *mdes= c, struct snp_guest_req *req */ memcpy(mdesc->request, &mdesc->secret_request, sizeof(mdesc->secret_reque= st)); =20 + /* initial the input address for guest request */ + req->input.req_gpa =3D __pa(mdesc->request); + req->input.resp_gpa =3D __pa(mdesc->response); + req->input.data_gpa =3D req->certs_data ? __pa(req->certs_data) : 0; + rc =3D __handle_guest_request(mdesc, req, rio); if (rc) { if (rc =3D=3D -EIO && diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/se= v-guest/sev-guest.c index 4699fdc9ed44..cf3fb61f4d5b 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -177,6 +177,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev= , struct snp_guest_reques struct snp_guest_req req =3D {}; int ret, npages =3D 0, resp_len; sockptr_t certs_address; + struct page *page; =20 if (sockptr_is_null(io->req_data) || sockptr_is_null(io->resp_data)) return -EINVAL; @@ -210,8 +211,20 @@ static int get_ext_report(struct snp_guest_dev *snp_de= v, struct snp_guest_reques * the host. If host does not supply any certs in it, then copy * zeros to indicate that certificate data was not provided. */ - memset(mdesc->certs_data, 0, report_req->certs_len); npages =3D report_req->certs_len >> PAGE_SHIFT; + page =3D alloc_pages(GFP_KERNEL_ACCOUNT | __GFP_ZERO, + get_order(report_req->certs_len)); + if (!page) + return -ENOMEM; + + req.certs_data =3D page_address(page); + ret =3D set_memory_decrypted((unsigned long)req.certs_data, npages); + if (ret) { + pr_err("failed to mark page shared, ret=3D%d\n", ret); + __free_pages(page, get_order(report_req->certs_len)); + return -EFAULT; + } + cmd: /* * The intermediate response buffer is used while decrypting the @@ -220,10 +233,12 @@ static int get_ext_report(struct snp_guest_dev *snp_d= ev, struct snp_guest_reques */ resp_len =3D sizeof(report_resp->data) + mdesc->ctx->authsize; report_resp =3D kzalloc(resp_len, GFP_KERNEL_ACCOUNT); - if (!report_resp) - return -ENOMEM; + if (!report_resp) { + ret =3D -ENOMEM; + goto e_free_data; + } =20 - mdesc->input.data_npages =3D npages; + req.input.data_npages =3D npages; =20 req.msg_version =3D arg->msg_version; req.msg_type =3D SNP_MSG_REPORT_REQ; @@ -238,7 +253,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev= , struct snp_guest_reques =20 /* If certs length is invalid then copy the returned length */ if (arg->vmm_error =3D=3D SNP_GUEST_VMM_ERR_INVALID_LEN) { - report_req->certs_len =3D mdesc->input.data_npages << PAGE_SHIFT; + report_req->certs_len =3D req.input.data_npages << PAGE_SHIFT; =20 if (copy_to_sockptr(io->req_data, report_req, sizeof(*report_req))) ret =3D -EFAULT; @@ -247,7 +262,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev= , struct snp_guest_reques if (ret) goto e_free; =20 - if (npages && copy_to_sockptr(certs_address, mdesc->certs_data, report_re= q->certs_len)) { + if (npages && copy_to_sockptr(certs_address, req.certs_data, report_req->= certs_len)) { ret =3D -EFAULT; goto e_free; } @@ -257,6 +272,13 @@ static int get_ext_report(struct snp_guest_dev *snp_de= v, struct snp_guest_reques =20 e_free: kfree(report_resp); +e_free_data: + if (npages) { + if (set_memory_encrypted((unsigned long)req.certs_data, npages)) + WARN_ONCE(ret, "failed to restore encryption mask (leak it)\n"); + else + __free_pages(page, get_order(report_req->certs_len)); + } return ret; } =20 --=20 2.47.1