summaryrefslogtreecommitdiff
path: root/io_uring/tctx.c
diff options
context:
space:
mode:
authorJoerg Roedel <jroedel@suse.de>2023-10-16 14:42:50 +0200
committerBorislav Petkov (AMD) <bp@alien8.de>2023-10-17 10:58:16 +0200
commit63e44bc52047f182601e7817da969a105aa1f721 (patch)
tree3a627e7e557da4e8273458595a8483fab82b2fa4 /io_uring/tctx.c
parentb9cb9c45583b911e0db71d09caa6b56469eb2bdf (diff)
downloadlinux-63e44bc52047f182601e7817da969a105aa1f721.tar.gz
linux-63e44bc52047f182601e7817da969a105aa1f721.tar.bz2
linux-63e44bc52047f182601e7817da969a105aa1f721.zip
x86/sev: Check for user-space IOIO pointing to kernel space
Check the memory operand of INS/OUTS before emulating the instruction. The #VC exception can get raised from user-space, but the memory operand can be manipulated to access kernel memory before the emulation actually begins and after the exception handler has run. [ bp: Massage commit message. ] Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler") Reported-by: Tom Dohrmann <erbse.13@gmx.de> Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: <stable@kernel.org>
Diffstat (limited to 'io_uring/tctx.c')
0 files changed, 0 insertions, 0 deletions