Re: [Part2 PATCH v5.1 12.7/31] crypto: ccp: Implement SEV_PEK_CSR ioctl command

[Borislav Petkov]

On Thu, Oct 12, 2017 at 09:24:01PM -0500, Brijesh Singh wrote:
> I assume you mean performing the SEV state check before allocating the
> memory for the CSR blob, right ?

I mean, do those first:

        if (copy_from_user(&input, (void __user *)argp->data, sizeof(input)))
                return -EFAULT;

        if (!input.address)
                return -EINVAL;

        /* allocate a physically contiguous buffer to store the CSR blob */
        if (!access_ok(VERIFY_WRITE, input.address, input.length) ||
            input.length > SEV_FW_BLOB_MAX_SIZE)
                return -EFAULT;


Because if you allocate the memory first and some of those checks fail,
you allocate in vain to free it immediately after. And you can save
yourself all that.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix ImendÃrffer, Jane Smithard, Graham Norton, HRB 21284 (AG NÃrnberg)
--