From: Kele Huang <kele@cs.columbia.edu>
To: pbonzini@redhat.com
Cc: kvm@vger.kernel.org, Kele Huang <kele@cs.columbia.edu>
Subject: [1/1] KVM: restrict kvm_gfn_to_hva_cache_init() to only accept address ranges within one page
Date: Mon, 22 Apr 2024 22:49:33 -0400 [thread overview]
Message-ID: <20240423024933.80143-1-kele@cs.columbia.edu> (raw)
Function kvm_gfn_to_hva_cache_init() is exported and used to init
gfn to hva cache at various places, such as called in function
kvm_pv_enable_async_pf(). However, this function directly tail
calls function __kvm_gfn_to_hva_cache_init(), which assigns
ghc->memslot to NULL and returns 0 for cache initialization of
cross pages cache. This is unsafe as 0 typically means a successful
return, but it actually fails to return a valid ghc->memslot.
The functions call kvm_gfn_to_hva_cache_init(), such as
kvm_lapic_set_vapicz_addr() do not make future checking on the
ghc->memslot if kvm_gfn_to_hva_cache_init() returns a 0. Moreover,
other developers may try to initialize a cache across pages by
calling this function but fail with a success return value.
This patch fixes this issue by explicitly restricting function
kvm_gfn_to_hva_cache_init() to only accept address ranges within
one page and adding comments to the function accordingly.
Signed-off-by: Kele Huang <kele@cs.columbia.edu>
---
virt/kvm/kvm_main.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 9230ebe1753f..6efe579f6b5f 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3476,11 +3476,22 @@ static int __kvm_gfn_to_hva_cache_init(struct kvm_memslots *slots,
return 0;
}
+/*
+ * Please note that this function only supports gfn_to_hva_cache
+ * initialization within a single page.
+ */
int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
gpa_t gpa, unsigned long len)
{
struct kvm_memslots *slots = kvm_memslots(kvm);
- return __kvm_gfn_to_hva_cache_init(slots, ghc, gpa, len);
+ gfn_t start_gfn = gpa >> PAGE_SHIFT;
+ gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
+ gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
+
+ if (likely(nr_pages_needed == 1))
+ return __kvm_gfn_to_hva_cache_init(slots, ghc, gpa, len);
+ else
+ return -EINVAL;
}
EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
--
2.44.0
next reply other threads:[~2024-04-23 3:18 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-23 2:49 Kele Huang [this message]
2024-04-26 1:16 ` [1/1] KVM: restrict kvm_gfn_to_hva_cache_init() to only accept address ranges within one page Chen, Zide
[not found] ` <CAOfLF_L2UgSUyUsbiBDhLPskt2xLWujy1GBAhpcWzi2i3brAww@mail.gmail.com>
2024-04-26 4:18 ` Kele Huang
2024-04-26 16:17 ` Sean Christopherson
2024-04-27 4:27 ` Kele Huang
2024-04-29 20:13 ` Sean Christopherson
2024-04-30 19:29 ` Kele Huang
2024-04-26 6:25 ` Christoph Hellwig
2024-04-27 3:50 ` Kele Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240423024933.80143-1-kele@cs.columbia.edu \
--to=kele@cs.columbia.edu \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).