Add an explicit access_ok() check on EADD's source page to avoid passing garbage to gup(). Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> --- arch/x86/kernel/cpu/sgx/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index 2dd0eceee111..7d1b449bf771 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -498,6 +498,9 @@ static long sgx_ioc_enclave_add_page(struct sgx_encl *encl, void __user *arg) !IS_ALIGNED(addp.src, PAGE_SIZE)) return -EINVAL; + if (!(access_ok(addp.src, PAGE_SIZE))) + return -EFAULT; + if (addp.addr < encl->base || addp.addr - encl->base >= encl->size) return -EINVAL; -- 2.22.0
