Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bcc2850f-f74b-1e5f-84d0-e860ffe6876e@amd.com>
Date:   Thu, 21 Apr 2022 08:26:39 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH v2] crypto: ccp - Fix the INIT_EX data file open failure
Content-Language: en-US
To:     Jacky Li <jackyli@google.com>,
        Brijesh Singh <brijesh.singh@amd.com>,
        John Allen <john.allen@amd.com>
Cc:     Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        Marc Orr <marcorr@google.com>, Alper Gun <alpergun@google.com>,
        Peter Gonda <pgonda@google.com>, linux-crypto@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20220414162325.1830014-1-jackyli@google.com>
From:   Tom Lendacky <thomas.lendacky@amd.com>
In-Reply-To: <20220414162325.1830014-1-jackyli@google.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?anlUUzhFa2QwcHc5ZnIvUW5raVpPWENmbmwyWjR4QVI5RUtYSXUxajJIeXlB?=
 =?utf-8?B?U1VJTWMrdFkrRHJVWC9aSGw4Y3NTRklBNUhLMFpybXJFMkNQVHU0RVhWekVL?=
 =?utf-8?B?MW5VeEsrZXIrWTE3bjVrMU1tR29tOS9QU05jYlMwd2NjYUgyZjR5eVUwblhD?=
 =?utf-8?B?Wm9KODdFVVYyV08rL3hQbkVkQU1RUzE5WG54cTB5WXhqb3Vqa2FSZ3pkRjRk?=
 =?utf-8?B?aFF3di90NW1ja2hLYlJPUHdzL21GZzkzNUF2cDIwalNLczlCR3FKdlRmS2lr?=
 =?utf-8?B?WGpISEdwOXpITWp2NW1QMlV2eGZJY3JHRHlUSWVnVkxqL3E1Q29aeXRQWHds?=
 =?utf-8?B?TklwVXI2NGVSaHhkWks1WFd5eGhqbWVOaXdvSDNYVW1jUFlHa2kvbmVmNDhp?=
 =?utf-8?B?YVdjWWtuM21XTzhpQXR0amRVb0pCQnVFdnhSS21hVkdTRzFqMmVwOCtXVTdO?=
 =?utf-8?B?UlBDTUxpOU5iaUkxdEdqY1o1RHVvaFRNWFRuc253b3dia1l6c05wbUFzYVNi?=
 =?utf-8?B?ZGZXTndmVXJGTHltd3c1UmM1SXZBRkNubWtmYS9qVWxFNDc5OFUwRGxPamlX?=
 =?utf-8?B?T3ZJc1IvamNjTituYzJXZEdSM2dtNGJjcnZILzhrNXN6UTlHME96MUVFYmtN?=
 =?utf-8?B?YmhxZHI2QnVMcVdidDlyY3pnQWg5akFNRkhra1diYUtPTTlwdkw3SkRvZVh6?=
 =?utf-8?B?cTZFQVdJano1MTczNnAxeFAydVhNQk9pYUJ4R0ltSFZNZHY0Zk5IQTI3Q2tm?=
 =?utf-8?B?Z2VTUS9pSVVmN2FTZ0xNNUE3Vk1lVTNvN3VsZ29qZ2pWdkxoamd0SHpPaWo1?=
 =?utf-8?B?OHE0ZmZab3FFRE1HWHBrWEpmK0JFRTVvb21MZGo2blJUQ3lia1pqajN3ZzdW?=
 =?utf-8?B?S24xd1dhZk5VcHJYWW1GcGRzMURvUHlXN1JVTTlCWStkQ21XOXBudUN0ekQz?=
 =?utf-8?B?OWpKQ20ranV0TUFaalpHUy9SUC9KbTZ3OUoxc3ZpOXN5TVNFTHlmd2NPdm9K?=
 =?utf-8?B?a2ZZR3JzQzJ0RlIyYjFYSW5MQ3I5QWIrWlNXbUtjOG9oMU41QWJJbE1Ld1p6?=
 =?utf-8?B?cXIxU3N3cXQrUU1qSSsvWXlzUzFDU1BUMFI1TG1MOEl2TytvTXNrYU5vamhr?=
 =?utf-8?B?RnlRYllJd0JxQXRFczBSWFJBTkljczNQd2ZEWW5UVkhtMmR6MlZuS09yamJh?=
 =?utf-8?B?VDMzQ0Y5QStFNkZabjc1SWZGeC9IMXR0eUJtazY4RlJ6T3VwV1NJK1crVTFR?=
 =?utf-8?B?dVM0dDI3akorT1dGdHVDVFVLcXFiekZRQnFJTCtpcGNYMUR1d2FpZ1lGQlpw?=
 =?utf-8?B?YjArdUgrVHN2NGN4SnIzdDdETTQvUVh4clBYRjFudjd0QmV3c3hLdStxTGpi?=
 =?utf-8?B?VElHTzZQVUZ1N1lIL05BeHRBUlNsVXNjdC9jeElDTndhSVdNUVNpejNJZVBh?=
 =?utf-8?B?eUFrZi9xMUJMb3EySFdScTBsdWM1UmdNUitVcWt6aTFENU44RXNXTzdJeVFK?=
 =?utf-8?B?dkxxVmlnSGZIUEhodkh1Z1p3NDRFb3JoY0x1cVNTOE4yYk5lUlpWazRYVFJk?=
 =?utf-8?B?bC9vUkl0cXBaK2FnN0lVS1g1cWFFazY1NUdYaVRxOGw2Ui9EMEE1bk4xQSti?=
 =?utf-8?B?YlRNQ1oweUI2eHNhczUyQi9zOHNwd0FicmRCY00vQXpLU3dOcTIvUzd2RG92?=
 =?utf-8?B?NVB5QkxJLzJWaW1CUThianpBSnpQZFBoVUh0UUlZVmdobHc2SmtPSkEwSi82?=
 =?utf-8?B?TkJxWmZtbXJwYUp3aGNtVkZVVHJpemZqa3JMMDdsejlHRis5YmlsR0hLckNn?=
 =?utf-8?B?eUNuVXVNUFJCQXRUVmpuRmsyUHRSNFNOcFZPTkpyUkZtSjBhQ3MxN3ovK2NO?=
 =?utf-8?B?aTVXeHJxQTJFZlMzaDIyTkZHanJaZHNUWnlMekdRb0xDZm11QmFuaEk4cFlt?=
 =?utf-8?B?dmVJRlRIeko0aGpVZUYrUjUyZnA1VXNvUTk3Wk1NelorOXNJSzdaL3hUYlZs?=
 =?utf-8?B?SmVjckpHbWI5QS85YW5XUnB6clBZdE9VRm9iVWdQRmgza1dJb1VKMnh5UXkv?=
 =?utf-8?B?Z05EaVVlQTFUclkreklCWnZyRUF3bzdKYWQzSWw2dlIrbzRDMGZ6Mlhqb0Za?=
 =?utf-8?B?NGtjRFJBRkFKRjV2SkJZK2xaekl1ZW5VZGVhZktaRzBDRjVQVGFJbTAwQ0dG?=
 =?utf-8?B?YituRThITUJuYzRrWndOQ21xOGxHampyTGdQeVpFQi80VWNWWFJKcFhjM0VP?=
 =?utf-8?B?N2IydmpjTU14djEyOUYvc2dYc2RZOFZNTEQyMStkQkZiRUM5K085b2R6Y1NY?=
 =?utf-8?B?WFFFMXZTZTNYYXZ3Z1p5OVNmam9QS1hrd1dHdGR0UkVpK1E5cVVpUT09?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b06c43dd-62df-4a16-9e18-08da239a927b
X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5221.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Apr 2022 13:26:41.6950
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: u7gGVmL+qcjgl3avRmslvvSLuz3p9YmdOsVDBjqdmXWeNiPwoU1VOOBdEaZ9jCSrUzh3IdqPZE30sdL6BlBAbA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1596
X-Spam-Status: No, score=-5.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On 4/14/22 11:23, Jacky Li wrote:
> There are 2 common cases when INIT_EX data file might not be
> opened successfully and fail the sev initialization:
> 
> 1. In user namespaces, normal user tasks (e.g. VMM) can change their
>     current->fs->root to point to arbitrary directories. While
>     init_ex_path is provided as a module param related to root file
>     system. Solution: use the root directory of init_task to avoid
>     accessing the wrong file.
> 
> 2. Normal user tasks (e.g. VMM) don't have the privilege to access
>     the INIT_EX data file. Solution: open the file as root and
>     restore permissions immediately.
> 
> Fixes: 3d725965f836 ("crypto: ccp - Add SEV_INIT_EX support")
> Signed-off-by: Jacky Li <jackyli@google.com>
> Reviewed-by: Peter Gonda <pgonda@google.com>

Acked-by: Tom Lendacky <thomas.lendacky@amd.com>

> ---
> Changelog since v1:
> - Added Fixes tag and Reviewed-By tag.
> 
>   drivers/crypto/ccp/sev-dev.c | 30 ++++++++++++++++++++++++++++--
>   1 file changed, 28 insertions(+), 2 deletions(-)
>