CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages

In the Linux kernel, the following vulnerability has been resolved:

x86/sgx: Prevent attempts to reclaim poisoned pages

TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it knows are poisoned. Avoid even trying to reclaim poisoned pages.

The longer story:

Pages used by an enclave only get epcpage->poison set in archmemoryfailure() but they currently stay on sgxactivepagelist until sgxenclrelease(), with the SGXEPCPAGERECLAIMERTRACKED flag untouched.

epcpage->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic.

Specifically, reclaiming uses microcode operations including "EWB" which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time.

Call sgxunmarkpagereclaimable() to remove the affected EPC page from sgxactivepagelist on memory error to stop it being considered for reclaiming.

Testing epcpage->poison in sgxreclaimpages() would also work but I assume it's better to add code in the less likely paths.

The affected EPC page is not added to &node->sgxpoisonpagelist until later in sgxenclrelease()->sgxfreeepcpage() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgxactivepagelist. There's a "TBD" comment in archmemoryfailure() about pre-emptive actions, the goal here is not to address everything that it may imply.

This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgxreclaimpages() has selected its candidates or even inside a microcode operation (actually easy to trigger due to the amount of time spent in them.)

The spinlock in sgxunmarkpagereclaimable() is safe because memoryfailure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment.