[PATCH 01/19] nitro_enclaves: Release the reference on a rejected region page

[Alexander Graf]

A process that passes ordinary anonymous memory to
NE_SET_USER_MEMORY_REGION can leak one page reference each time the driver
rejects it with NE_ERR_MEM_NOT_HUGE_PAGE. Any process with permission to open
/dev/nitro_enclaves and create an enclave can repeat that, which may lead
to situations where the system runs out of memory.

The ioctl takes a reference on one page at a time and only counts it in
ne_mem_region->nr_pages once that page has passed both of the checks
that follow, ne_sanity_check_user_mem_region_page() and
ne_merge_phys_contig_memory_regions(). The put_pages unwind walks
[0, nr_pages), so it misses the page whose check just failed.

Count the reference as soon as get_user_pages_unlocked() reports it, so
that the unwind covers it.

Fixes: 7dc9d4309fdb ("nitro_enclaves: Add logic for setting an enclave memory region")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Alexander Graf <graf@xxxxxxxxxx>
---
 drivers/virt/nitro_enclaves/ne_misc_dev.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.c b/drivers/virt/nitro_enclaves/ne_misc_dev.c
index 0d7bdad924b73..a50dc4f737b55 100644
--- a/drivers/virt/nitro_enclaves/ne_misc_dev.c
+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.c
@@ -963,8 +963,8 @@ static int ne_set_user_memory_region_ioctl(struct ne_enclave *ne_enclave,
 		gup_rc = get_user_pages_unlocked(mem_region.userspace_addr + memory_size, 1,
 						 ne_mem_region->pages + i, FOLL_GET);
 
-		if (gup_rc < 0) {
-			rc = gup_rc;
+		if (gup_rc != 1) {
+			rc = gup_rc < 0 ? gup_rc : -EFAULT;
 
 			dev_err_ratelimited(ne_misc_dev.this_device,
 					    "Error in get user pages [rc=%d]\n", rc);
@@ -972,6 +972,12 @@ static int ne_set_user_memory_region_ioctl(struct ne_enclave *ne_enclave,
 			goto put_pages;
 		}
 
+		/*
+		 * Count the reference before the checks below, so that the
+		 * put_pages unwind releases this page as well.
+		 */
+		ne_mem_region->nr_pages++;
+
 		rc = ne_sanity_check_user_mem_region_page(ne_enclave, ne_mem_region->pages[i]);
 		if (rc < 0)
 			goto put_pages;
@@ -983,8 +989,6 @@ static int ne_set_user_memory_region_ioctl(struct ne_enclave *ne_enclave,
 			goto put_pages;
 
 		memory_size += page_size(ne_mem_region->pages[i]);
-
-		ne_mem_region->nr_pages++;
 	} while (memory_size < mem_region.memory_size);
 
 	if ((ne_enclave->nr_mem_regions + phys_contig_mem_regions.num) >
-- 
2.47.1