Check that the destination enclave address is page aligned, i.e. bits 11:0 are zero. The userspace controlled address is used to initialize page->desc, e.g. userspace can set kernel-internal flags by passing in an unaligned address. Reported-by: Shay Katz-zamir <shay.katz-zamir@xxxxxxxxx> Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> --- arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c index ebb71eb3323a..ae381bf4cfd7 100644 --- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c @@ -600,6 +600,9 @@ static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg) if (copy_from_user(&addp, arg, sizeof(addp))) return -EFAULT; + if (!IS_ALIGNED(addp.addr, PAGE_SIZE)) + return -EINVAL; + if (copy_from_user(&secinfo, (void __user *)addp.secinfo, sizeof(secinfo))) return -EFAULT; -- 2.22.0
