intel / intel/confidential-computing.sgx.sdk
SampleEnclave lfence() question
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Hello!
I hope my message finds you well. I have a question, possibly silly, regarding the SampleEnclave code. As I understand it, the `[user_check]` keyword means that it is up to the user (developer) to validate the pointer that is passed as an argument to the ecall. So, in SampleEnclave code we have the following example for the implementation of an ecall that has a pointer as an argument, i.e., the implementation of `ecall_pointer_user_check`:
```cpp
size_t ecall_pointer_user_check(void* val, size_t sz)
{
/* check if the buffer is allocated outside */
if (sgx_is_outside_enclave(val, sz) != 1)
abort();
/*fence after sgx_is_outside_enclave check*/
sgx_lfence();
char tmp[100] = { 0 };
size_t len = sz > 100 ? 100 : sz;
/* copy the memory into the enclave to make sure 'val'
* is not being changed in checksum_internal() */
memcpy(tmp, val, len);
int32_t sum = checksum_internal((char*)tmp, len);
printf("Checksum(0x%p, %zu) = 0x%x\n",
val, len, (unsigned int)sum);
/* modify outside memory directly */
memcpy(val, "SGX_SUCCESS", len > 12 ? 12 : len);
return len;
}
```
But on the other hand, there is another example, `ecall_array_user_check`
```cpp
void ecall_array_user_check(int arr[4])
{
if (sgx_is_outside_enclave(arr, 4 * sizeof(int)) != 1)
abort();
for (int i = 0; i < 4; i++) {
assert(arr[i] == i);
arr[i] = 3 - i;
}
}
```
My question is why in the former case we call `sgx_lfence()` after the `sgx_is_outside_enclave` check, whereas in the latter we do not? Does it not pose a security threat to omit the `lfence()` after validation in `[user_check]`-type functions?
Contributor guide
Assessment
This issue has not been assessed yet.