Skip to content

Commit f0861f4

Browse files
boryspoplawskisuryasaimadhu
authored andcommitted
x86/sgx: Add overflow check in sgx_validate_offset_length()
sgx_validate_offset_length() function verifies "offset" and "length" arguments provided by userspace, but was missing an overflow check on their addition. Add it. Fixes: c6d26d3 ("x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES") Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Cc: stable@vger.kernel.org # v5.11+ Link: https://lore.kernel.org/r/0d91ac79-6d84-abed-5821-4dbe59fa1a38@invisiblethingslab.com
1 parent f0c4d9f commit f0861f4

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

arch/x86/kernel/cpu/sgx/ioctl.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,9 @@ static int sgx_validate_offset_length(struct sgx_encl *encl,
356356
if (!length || !IS_ALIGNED(length, PAGE_SIZE))
357357
return -EINVAL;
358358

359+
if (offset + length < offset)
360+
return -EINVAL;
361+
359362
if (offset + length - PAGE_SIZE >= encl->size)
360363
return -EINVAL;
361364

0 commit comments

Comments
 (0)