Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 17 May 2022 11:06:07 -0500
From:   John Allen <john.allen@amd.com>
To:     Tom Lendacky <thomas.lendacky@amd.com>
Cc:     herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org,
        seanjc@google.com, Ashish.Kalra@amd.com,
        linux-kernel@vger.kernel.org, theflow@google.com,
        rientjes@google.com, pgonda@google.com, stable@vger.kernel.org
Subject: Re: [PATCH v3] crypto: ccp - Use kzalloc for sev ioctl interfaces to
 prevent kernel memory leak
Message-ID: <YoPH7ztF50b6ge9G@dell9853host>
References: <20220517153958.262959-1-john.allen@amd.com>
 <e0d23029-21e9-b1bb-9d35-1bfcdd3dca12@amd.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <e0d23029-21e9-b1bb-9d35-1bfcdd3dca12@amd.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?id3hf4gm0btW56cA5CL8tRdx8iK4UjRuPe5z4DTupuEvGpxxmqFIETQQd1t6?=
 =?us-ascii?Q?N/nE9FWZNyvvEhQhV10hMulvdLEft8KfxQRgLVNAm8KYbovieP+sV3zEi3bz?=
 =?us-ascii?Q?e5NQYeQzwg757299JG0JEH2ngFHRRL++/VFv1xppECYO5zzB6Kh547HIk1+E?=
 =?us-ascii?Q?SELQ2PURnPCOSdHRA8+QupJAMt2iHV3IawgRVBv/8qTT1jMKt+pwBQG776rr?=
 =?us-ascii?Q?/Ma5u93UpQtr8YPi5Fpf8ZAnpQlU4fLBg16FVxbRXHOXxFEK1/WwSzjfxjP7?=
 =?us-ascii?Q?uVhwFTTdozKZeVP3ycWhzPy60HW6DcK2rMt0lb+O979NbXdJHNaevJKuPZvA?=
 =?us-ascii?Q?7OjD9X8hljD8byIdcabiYmQ2Q+GkQ5Sj/wfyJrVbrTdjcDB7zqAD8L20gge4?=
 =?us-ascii?Q?Gqjq3CfToqNuEaMjGZ91kF+OHbM+Mpzvr7nzPWg+GX5cF1nrzODoDHur+grm?=
 =?us-ascii?Q?ad1mloO/hQf7skjluE1qutEnVkIDQs3+wtEyzPaGPImIyZfyIuieCA3M9tcF?=
 =?us-ascii?Q?uAakFzuro5nFNabcig4QFsHEymaXLcihOtCtK6LUf+PAK/BntIcB/SlnwNWS?=
 =?us-ascii?Q?OyhxorJXNLr07X9fM89UESCWbqgIshnDB/2qjdyt8Auopf7sZFlvxAIWrAWc?=
 =?us-ascii?Q?XqUu0qYKS8qlrBcfucAVHxUbuXpSR/R97Qlehskz+qulb7s/8en0+rGgGafa?=
 =?us-ascii?Q?E+wbGtAln+aX+uIioZ8XeFaMLrrl3rtkzSoHhl6wj4ln5bwHVQSWzn6nLWD9?=
 =?us-ascii?Q?kMgvlQD6tvYdigUED2tDDlPOekkvVfLNL6ribPBGQYiPit+SQCxO13pSPKQg?=
 =?us-ascii?Q?PGHJZuNAR4ydqYYtGTpAWnd4VbI23F0rQRC4YHFT+in2+uJ2E1vc/YJ29fYy?=
 =?us-ascii?Q?wOqc+32oFtxyEW8x7+jJKLVBLn9A9nSutFDnWBqtE3aS8ELPlb767QR39sSN?=
 =?us-ascii?Q?C+hgXzAW0ndf/wtSZMZggBs8++Tj5w4mSpZ85/gcYgBpp6WCE7xKCnHZ5Twb?=
 =?us-ascii?Q?Xim4zWd7IVSsD9/ASUxRMF6hlT7DWHaRTFDU0cvgA6rCUrxiw5a5vnGwLMto?=
 =?us-ascii?Q?Oi7Q7uioFxOEIxEKx/3GQOAojR5k67nSRNo/c0SxcCmp+1AWw+V1d6RsS+TA?=
 =?us-ascii?Q?ZFIA0tVVUN3xwh/vTcU9HJ29WcDEKzhPqw8j0fD2nT/XL3q/6VKU0lK0Jp52?=
 =?us-ascii?Q?06mS8v7gxMklJHlhQcYYKhKn+9W8p4ZlWiQUnrhcmUHhHUX7YkiFxx5pbAq8?=
 =?us-ascii?Q?x3fUG17SdUfvfXDkfyjy6X7xEWWi0s2cBzG062L5G170WqcVMagCY9gX6Zvt?=
 =?us-ascii?Q?ZvXHYmZTkaLeq3pC4jBVeU9d+ObhhUp7QDoCcAmFFpa3qFQ+D4So8kBpSO0W?=
 =?us-ascii?Q?JnDPBlplgS88wgIbSE1AIO0Y4WQbwkbUzh7bEDdGM41TeaW4cKesGGkh7NM+?=
 =?us-ascii?Q?7CHlnQIrCybFljQdG/lFlcKr9j+BASxrlHnKwkNqx3kPicEAqVPcHHmDbHuo?=
 =?us-ascii?Q?Pj4mUnlYbn4WeGO+c+2mMnf7Toc2IejA57I8R8MBNRfVnU/ivW5pf/AilpLf?=
 =?us-ascii?Q?kkdAKiMmYNHhukXqoGu/ieIiu4wA5sIKujQA5VJ2D3n+JQBqIgDScAHp1GXO?=
 =?us-ascii?Q?bhho5+CFrnu9NS+/P5w1BL8vOdQIbaN/5p5zAW/8Bx1CiXtMr9xBSdZ9gSUY?=
 =?us-ascii?Q?mf5siaKl+AooC8KFeLRx/gnoKBrSJswVXr8dOoXf94YdaRmPlhQWa/ok4yLn?=
 =?us-ascii?Q?8T+qrpPhwg=3D=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 46e0a8ea-e53d-4fb4-be17-08da381f28a8
X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5995.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2022 16:06:10.4874
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: b5B1bTBK4PapBnVBp4Q4nHUvLx9yL2n65+EOWGuw3riprQxC+AZophqAZXoj6UpJLIyaqsha93CvAbbxg6KSGg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR12MB3445
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, May 17, 2022 at 10:50:08AM -0500, Tom Lendacky wrote:
> On 5/17/22 10:39, John Allen wrote:
> > For some sev ioctl interfaces, input may be passed that is less than or
> > equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP
> > firmware returns. In this case, kmalloc will allocate memory that is the
> > size of the input rather than the size of the data. Since PSP firmware
> > doesn't fully overwrite the buffer, the sev ioctl interfaces with the
> > issue may return uninitialized slab memory.
> > 
> > Currently, all of the ioctl interfaces in the ccp driver are safe, but
> > to prevent future problems, change all ioctl interfaces that allocate
> > memory with kmalloc to use kzalloc and memset the data buffer to zero in
> > sev_ioctl_do_platform_status.
> > 
> > Fixes: e799035609e15 ("crypto: ccp: Implement SEV_PEK_CSR ioctl command")
> > Fixes: 76a2b524a4b1d ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
> > Fixes: d6112ea0cb344 ("crypto: ccp - introduce SEV_GET_ID2 command")
> > Cc: stable@vger.kernel.org
> > Reported-by: Andy Nguyen <theflow@google.com>
> > Suggested-by: David Rientjes <rientjes@google.com>
> > Suggested-by: Peter Gonda <pgonda@google.com>
> > Signed-off-by: John Allen <john.allen@amd.com>
> > ---
> > v2:
> >    - Add fixes tags and CC stable@vger.kernel.org
> > v3:
> >    - memset data buffer to zero in sev_ioctl_do_platform_status
> > ---
> >   drivers/crypto/ccp/sev-dev.c | 10 ++++++----
> >   1 file changed, 6 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> > index 6ab93dfd478a..da143cc3a8f5 100644
> > --- a/drivers/crypto/ccp/sev-dev.c
> > +++ b/drivers/crypto/ccp/sev-dev.c
> > @@ -551,6 +551,8 @@ static int sev_ioctl_do_platform_status(struct sev_issue_cmd *argp)
> >   	struct sev_user_data_status data;
> >   	int ret;
> > +	memset(&data, 0, sizeof(data));
> > +
> 
> Probably needs an additional Fixes: tag now?
> 
> Fixes: 38103671aad3 ("crypto: ccp: Use the stack and common buffer for status commands")

Thanks, Tom. I'll add the additional tag in the next revision.

Thanks,
John

> 
> Thanks,
> Tom
> 
> >   	ret = __sev_do_cmd_locked(SEV_CMD_PLATFORM_STATUS, &data, &argp->error);
> >   	if (ret)
> >   		return ret;
> > @@ -604,7 +606,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)
> >   	if (input.length > SEV_FW_BLOB_MAX_SIZE)
> >   		return -EFAULT;
> > -	blob = kmalloc(input.length, GFP_KERNEL);
> > +	blob = kzalloc(input.length, GFP_KERNEL);
> >   	if (!blob)
> >   		return -ENOMEM;
> > @@ -828,7 +830,7 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp)
> >   	input_address = (void __user *)input.address;
> >   	if (input.address && input.length) {
> > -		id_blob = kmalloc(input.length, GFP_KERNEL);
> > +		id_blob = kzalloc(input.length, GFP_KERNEL);
> >   		if (!id_blob)
> >   			return -ENOMEM;
> > @@ -947,14 +949,14 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
> >   	if (input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE)
> >   		return -EFAULT;
> > -	pdh_blob = kmalloc(input.pdh_cert_len, GFP_KERNEL);
> > +	pdh_blob = kzalloc(input.pdh_cert_len, GFP_KERNEL);
> >   	if (!pdh_blob)
> >   		return -ENOMEM;
> >   	data.pdh_cert_address = __psp_pa(pdh_blob);
> >   	data.pdh_cert_len = input.pdh_cert_len;
> > -	cert_blob = kmalloc(input.cert_chain_len, GFP_KERNEL);
> > +	cert_blob = kzalloc(input.cert_chain_len, GFP_KERNEL);
> >   	if (!cert_blob) {
> >   		ret = -ENOMEM;
> >   		goto e_free_pdh;