[PATCH v2 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

[Jing Zhang]

Hi Kunkun,

On Thu, Jul 4, 2024 at 7:23 AM Kunkun Jiang <jiangkunkun at huawei.com> wrote:
>
> In all the vgic_its_save_*() functinos, it does not check whether
typo: functions
> the data length is 8 bytes before calling vgic_write_guest_lock.
> This patch add the check. To prevent the kernel from being blown up
typo: adds
> when the fault occurs, KVM_BUG_ON() is used. And the other BUG_ON()'s
> are replaced together.
>
> Signed-off-by: Kunkun Jiang <jiangkunkun at huawei.com>
> ---
>  arch/arm64/kvm/vgic/vgic-its.c | 21 +++++++++++++++++++--
>  1 file changed, 19 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
> index 40bb43f20bf3..344bd8c20f67 100644
> --- a/arch/arm64/kvm/vgic/vgic-its.c
> +++ b/arch/arm64/kvm/vgic/vgic-its.c
> @@ -2094,6 +2094,10 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
>                ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
>                 ite->collection->collection_id;
>         val = cpu_to_le64(val);
> +
> +       if (KVM_BUG_ON(ite_esz != sizeof(val), kvm))
> +               return -EINVAL;
> +
>         return vgic_write_guest_lock(kvm, gpa, &val, ite_esz);
>  }
>
> @@ -2246,6 +2250,10 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
>                (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
>                 (dev->num_eventid_bits - 1));
>         val = cpu_to_le64(val);
> +
> +       if (KVM_BUG_ON(dte_esz != sizeof(val), kvm))
> +               return -EINVAL;
> +
>         return vgic_write_guest_lock(kvm, ptr, &val, dte_esz);
>  }
>
> @@ -2427,12 +2435,17 @@ static int vgic_its_save_cte(struct vgic_its *its,
>                              struct its_collection *collection,
>                              gpa_t gpa, int esz)
>  {
> +       struct kvm *kvm = its->dev->kvm;
>         u64 val;
>
>         val = (1ULL << KVM_ITS_CTE_VALID_SHIFT |
>                ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
>                collection->collection_id);
>         val = cpu_to_le64(val);
> +
> +       if (KVM_BUG_ON(esz != sizeof(val), kvm))
> +               return -EINVAL;
> +
>         return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz);
>  }
>
> @@ -2449,7 +2462,9 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
>         u64 val;
>         int ret;
>
> -       BUG_ON(esz > sizeof(val));
> +       if (KVM_BUG_ON(esz != sizeof(val), kvm))
> +               return -EINVAL;
> +
>         ret = kvm_read_guest_lock(kvm, gpa, &val, esz);
>         if (ret)
>                 return ret;
> @@ -2513,7 +2528,9 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
>          * with valid bit unset
>          */
>         val = 0;
> -       BUG_ON(cte_esz > sizeof(val));
> +       if (KVM_BUG_ON(cte_esz != sizeof(val), its->dev->kvm))
> +               return -EINVAL;
> +
>         ret = vgic_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
>         return ret;
>  }
> --
> 2.27.0
>
>

Jing