[PATCH v2 2/2] KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()

[Fuad Tabba]

On Fri, 10 Jul 2026 at 12:48, Vincent Donnefort <vdonnefort at google.com> wrote:
>
> The footprint calculated for struct hyp_trace_desc sizes only
> trace_buffer_desc and do not take into account the other fields. It
> worked so far thanks to the follow-up PAGE_ALIGN().
>
> Fix the descriptor size and while at it, enforce an overflow check after
> PAGE_ALIGN().
>
> Reported-by: Sashiko <sashiko-bot at kernel.org>
> Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp")
> Signed-off-by: Vincent Donnefort <vdonnefort at google.com>

Applied both patches on v7.2-rc2 and confirmed
arch/arm64/kvm/hyp_trace.c compiles (CONFIG_NVHE_EL2_TRACING=y).
Booted protected and non-protected VMs. To exercise hyp_trace_load()
directly I enabled the hypervisor trace remote via tracefs
(remotes/hypervisor/tracing_on) at the default 7KiB and reloaded at
512KiB, so the reworked desc_size/tb_desc_size split and the
alloc/map/share/__tracing_load path all ran fine.

Reviewed-by: Fuad Tabba <fuad.tabba at linux.dev>
Tested-by: Fuad Tabba < fuad.tabba at linux.dev>

Cheers,
/fuad

>
> diff --git a/arch/arm64/kvm/hyp_trace.c b/arch/arm64/kvm/hyp_trace.c
> index a7237aca6898..22437c5e1e7b 100644
> --- a/arch/arm64/kvm/hyp_trace.c
> +++ b/arch/arm64/kvm/hyp_trace.c
> @@ -235,18 +235,22 @@ static int hyp_trace_buffer_share_hyp(struct hyp_trace_buffer *trace_buffer)
>  static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)
>  {
>         struct hyp_trace_buffer *trace_buffer = priv;
> +       size_t desc_size, tb_desc_size;
>         struct hyp_trace_desc *desc;
> -       size_t desc_size;
>         int ret;
>
>         if (WARN_ON(trace_buffer->desc))
>                 return ERR_PTR(-EINVAL);
>
> -       desc_size = trace_buffer_desc_size(size, num_possible_cpus());
> +       tb_desc_size = trace_buffer_desc_size(size, num_possible_cpus());
> +       desc_size = size_add(tb_desc_size, offsetof(struct hyp_trace_desc, trace_buffer_desc));
>         if (desc_size == SIZE_MAX)
>                 return ERR_PTR(-E2BIG);
>
>         desc_size = PAGE_ALIGN(desc_size);
> +       if (!desc_size)
> +               return ERR_PTR(-E2BIG);
> +
>         desc = (struct hyp_trace_desc *)alloc_pages_exact(desc_size, GFP_KERNEL);
>         if (!desc)
>                 return ERR_PTR(-ENOMEM);
> @@ -262,7 +266,7 @@ static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)
>         if (ret)
>                 goto err_free_desc;
>
> -       ret = trace_remote_alloc_buffer(&desc->trace_buffer_desc, desc_size, size,
> +       ret = trace_remote_alloc_buffer(&desc->trace_buffer_desc, tb_desc_size, size,
>                                         cpu_possible_mask);
>         if (ret)
>                 goto err_free_backing;
> --
> 2.55.0.795.g602f6c329a-goog
>