tree cbe297094755b1beb2b9c92043705c6a9a94b91a
parent daf9b74f3e483bfe435a8dc9acfb3a6a2ecaf6ff
author Joerg Roedel <jroedel@suse.de> 1697460170 +0200
committer He Gao <hegao@google.com> 1699651213 +0000

x86/sev: Check for user-space IOIO pointing to kernel space

Upstream commit: 63e44bc52047f182601e7817da969a105aa1f721

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

Cherry-pick to release branch to fix CVE-2023-46813.

BUG=b/309761738
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2023-46813 in the Linux kernel.

Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Change-Id: I72b85cb1c102c230c41dbaf0ebeea9fb925379dd
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/60997
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Anil Altinay <aaltinay@google.com>