The following commit has been merged into the x86/urgent branch of tip:

Commit-ID: eb786ee1390b8fbba633c01a971709c6906fd8bf Gitweb: https://git.kernel.org/tip/eb786ee1390b8fbba633c01a971709c6906fd8bf Author: Kirill A. Shutemov kirill.shutemov@linux.intel.com AuthorDate: Mon, 26 Aug 2024 15:53:04 +03:00 Committer: Dave Hansen dave.hansen@linux.intel.com CommitterDate: Mon, 26 Aug 2024 07:04:09 -07:00

x86/tdx: Fix data leak in mmio_read()

The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM.

Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable on the stack to the VMM.

Do not send the original value of *val to the VMM.

Fixes: 31d58c4e557d ("x86/tdx: Handle in-kernel MMIO") Reported-by: Sean Christopherson seanjc@google.com Signed-off-by: Kirill A. Shutemov kirill.shutemov@linux.intel.com Signed-off-by: Dave Hansen dave.hansen@linux.intel.com Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240826125304.1566719-1-kirill.shutemov%40linux... --- arch/x86/coco/tdx/tdx.c | 1 - 1 file changed, 1 deletion(-)

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index 078e2ba..da8b66d 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -389,7 +389,6 @@ static bool mmio_read(int size, unsigned long addr, unsigned long *val) .r12 = size, .r13 = EPT_READ, .r14 = addr, - .r15 = *val, };

if (__tdx_hypercall(&args))