On Wed, Oct 02, 2024 at 02:23:59PM +0200, Alexey Gladkov (Intel) wrote:
> TDX only supports kernel-initiated MMIO operations. The handle_mmio()
> function checks if the #VE exception occurred in the kernel and rejects
> the operation if it did not.
>
> However, userspace can deceive the kernel into performing MMIO on its
> behalf. For example, if userspace can point a syscall to an MMIO address,
> syscall does get_user() or put_user() on it, triggering MMIO #VE. The
> kernel will treat the #VE as in-kernel MMIO.
>
> Ensure that the target MMIO address is within the kernel before decoding
> instruction.
>
> Fixes: 31d58c4e557d ("x86/tdx: Handle in-kernel MMIO")
> Signed-off-by: Alexey Gladkov (Intel) <legion@xxxxxxxxxx>
> Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
> Reviewed-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
> Acked-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
> Cc:stable@xxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/all/565a804b80387970460a4ebc67c88d1380f61ad1.1726237595.git.legion%40kernel.org
> (cherry picked from commit d4fc4d01471528da8a9797a065982e05090e1d81)
> Signed-off-by: Alexey Gladkov (Intel) <legion@xxxxxxxxxx>
> ---
> arch/x86/coco/tdx/tdx.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
Now queued up, thanks.
greg k-h
