Reject EADD if the destination address lies outside the bounds of the enclave's ELRANGE as tracked by encl->base and encl->size. Lack of a check allows userspace to induce a #GP on EADD. Reported-by: Shay Katz-zamir <shay.katz-zamir@xxxxxxxxx> Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> --- arch/x86/kernel/cpu/sgx/driver/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c index 11d90a31e7c2..6a580361e20e 100644 --- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c @@ -604,6 +604,9 @@ static long sgx_ioc_enclave_add_page(struct file *filep, void __user *arg) !IS_ALIGNED(addp.src, PAGE_SIZE)) return -EINVAL; + if (addp.addr < encl->base || addp.addr - encl->base >= encl->size) + return -EINVAL; + if (copy_from_user(&secinfo, (void __user *)addp.secinfo, sizeof(secinfo))) return -EFAULT; -- 2.22.0
