x86/tdx: Fix "in-kernel MMIO" check

JIRA: https://issues.redhat.com/browse/RHEL-63318
CVE: CVE-2024-47727

commit d4fc4d0
Author: Alexey Gladkov (Intel) <legion@kernel.org>
Date:   Fri Sep 13 19:05:56 2024 +0200

    x86/tdx: Fix "in-kernel MMIO" check

    TDX only supports kernel-initiated MMIO operations. The handle_mmio()
    function checks if the #VE exception occurred in the kernel and rejects
    the operation if it did not.

    However, userspace can deceive the kernel into performing MMIO on its
    behalf. For example, if userspace can point a syscall to an MMIO address,
    syscall does get_user() or put_user() on it, triggering MMIO #VE. The
    kernel will treat the #VE as in-kernel MMIO.

    Ensure that the target MMIO address is within the kernel before decoding
    instruction.

    Fixes: 31d58c4 ("x86/tdx: Handle in-kernel MMIO")
    Signed-off-by: Alexey Gladkov (Intel) <legion@kernel.org>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
    Cc:stable@vger.kernel.org
    Link: https://lore.kernel.org/all/565a804b80387970460a4ebc67c88d1380f61ad1.1726237595.git.legion%40kernel.org

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

Author: vittyvk

arch/x86/coco/tdx/tdx.c

@@ -16,6 +16,7 @@
 #include <asm/insn-eval.h>
 #include <asm/pgtable.h>
 #include <asm/set_memory.h>
+#include <asm/traps.h>
 
 /* MMIO direction */
 #define EPT_READ	0
@@ -532,6 +533,11 @@ static int handle_mmio(struct pt_regs *regs, struct ve_info *ve)
 			return -EINVAL;
 	}
 
+	if (!fault_in_kernel_space(ve->gla)) {
+		WARN_ONCE(1, "Access to userspace address is not supported");
+		return -EINVAL;
+	}
+
 	/*
 	 * Reject EPT violation #VEs that split pages.
 	 *