Patch "x86/traps: Fix load_unaligned_zeropad() handling for shared TDX memory" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    x86/traps: Fix load_unaligned_zeropad() handling for shared TDX memory

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     x86-traps-fix-load_unaligned_zeropad-handling-for-sh.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bcce2af7e83cf2da1661717f9a46ab31335a398d
Author: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
Date:   Tue Jul 25 02:03:29 2023 +0300

    x86/traps: Fix load_unaligned_zeropad() handling for shared TDX memory
    
    [ Upstream commit 9f9116406120638b4d8db3831ffbc430dd2e1e95 ]
    
    Commit c4e34dd99f2e ("x86: simplify load_unaligned_zeropad()
    implementation") changes how exceptions around load_unaligned_zeropad()
    handled.  The kernel now uses the fault_address in fixup_exception() to
    verify the address calculations for the load_unaligned_zeropad().
    
    It works fine for #PF, but breaks on #VE since no fault address is
    passed down to fixup_exception().
    
    Propagating ve_info.gla down to fixup_exception() resolves the issue.
    
    See commit 1e7769653b06 ("x86/tdx: Handle load_unaligned_zeropad()
    page-cross to a shared page") for more context.
    
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
    Reported-by: Michael Kelley <mikelley@xxxxxxxxxxxxx>
    Fixes: c4e34dd99f2e ("x86: simplify load_unaligned_zeropad() implementation")
    Acked-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
    Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 58b1f208eff51..4a817d20ce3bb 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -697,9 +697,10 @@ static bool try_fixup_enqcmd_gp(void)
 }
 
 static bool gp_try_fixup_and_notify(struct pt_regs *regs, int trapnr,
-				    unsigned long error_code, const char *str)
+				    unsigned long error_code, const char *str,
+				    unsigned long address)
 {
-	if (fixup_exception(regs, trapnr, error_code, 0))
+	if (fixup_exception(regs, trapnr, error_code, address))
 		return true;
 
 	current->thread.error_code = error_code;
@@ -759,7 +760,7 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 		goto exit;
 	}
 
-	if (gp_try_fixup_and_notify(regs, X86_TRAP_GP, error_code, desc))
+	if (gp_try_fixup_and_notify(regs, X86_TRAP_GP, error_code, desc, 0))
 		goto exit;
 
 	if (error_code)
@@ -1357,17 +1358,20 @@ DEFINE_IDTENTRY(exc_device_not_available)
 
 #define VE_FAULT_STR "VE fault"
 
-static void ve_raise_fault(struct pt_regs *regs, long error_code)
+static void ve_raise_fault(struct pt_regs *regs, long error_code,
+			   unsigned long address)
 {
 	if (user_mode(regs)) {
 		gp_user_force_sig_segv(regs, X86_TRAP_VE, error_code, VE_FAULT_STR);
 		return;
 	}
 
-	if (gp_try_fixup_and_notify(regs, X86_TRAP_VE, error_code, VE_FAULT_STR))
+	if (gp_try_fixup_and_notify(regs, X86_TRAP_VE, error_code,
+				    VE_FAULT_STR, address)) {
 		return;
+	}
 
-	die_addr(VE_FAULT_STR, regs, error_code, 0);
+	die_addr(VE_FAULT_STR, regs, error_code, address);
 }
 
 /*
@@ -1431,7 +1435,7 @@ DEFINE_IDTENTRY(exc_virtualization_exception)
 	 * it successfully, treat it as #GP(0) and handle it.
 	 */
 	if (!tdx_handle_virt_exception(regs, &ve))
-		ve_raise_fault(regs, 0);
+		ve_raise_fault(regs, 0, ve.gla);
 
 	cond_local_irq_disable(regs);
 }