Commit 2def950c authored by Thomas Huth's avatar Thomas Huth Committed by Paolo Bonzini
Browse files

KVM: arm64: Limit length in kvm_vm_ioctl_mte_copy_tags() to INT_MAX 



In case of success, this function returns the amount of handled bytes.
However, this does not work for large values: The function is called
from kvm_arch_vm_ioctl() (which still returns a long), which in turn
is called from kvm_vm_ioctl() in virt/kvm/kvm_main.c. And that function
stores the return value in an "int r" variable. So the upper 32-bits
of the "long" return value are lost there.

KVM ioctl functions should only return "int" values, so let's limit
the amount of bytes that can be requested here to INT_MAX to avoid
the problem with the truncated return value. We can then also change
the return type of the function to "int" to make it clearer that it
is not possible to return a "long" here.

Fixes: f0376edb ("KVM: arm64: Add ioctl to fetch/store tags in a guest")
Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Reviewed-by: default avatarGavin Shan <gshan@redhat.com>
Reviewed-by: default avatarSteven Price <steven.price@arm.com>
Message-Id: <20230208140105.655814-5-thuth@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent c5edd753

Documentation/virt/kvm/api.rst

+2 −1
Original line number Diff line number Diff line
@@ -5645,7 +5645,8 @@ with the KVM_XEN_VCPU_GET_ATTR ioctl. 
  };



Copies Memory Tagging Extension (MTE) tags to/from guest tag memory. The

``guest_ipa`` and ``length`` fields must be ``PAGE_SIZE`` aligned. The ``addr``

``guest_ipa`` and ``length`` fields must be ``PAGE_SIZE`` aligned.

``length`` must not be bigger than 2^31 - PAGE_SIZE bytes. The ``addr``

field must point to a buffer which the tags will be copied to or from.



``flags`` specifies the direction of copy, either ``KVM_ARM_TAGS_TO_GUEST`` or

arch/arm64/include/asm/kvm_host.h

+2 −2
Original line number Diff line number Diff line
@@ -1005,7 +1005,7 @@ int kvm_arm_vcpu_arch_get_attr(struct kvm_vcpu *vcpu, 
int kvm_arm_vcpu_arch_has_attr(struct kvm_vcpu *vcpu,

			       struct kvm_device_attr *attr);



long kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,

int kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,

			       struct kvm_arm_copy_mte_tags *copy_tags);



/* Guest/host FPSIMD coordination helpers */

arch/arm64/kvm/guest.c

+6 −2
Original line number Diff line number Diff line
@@ -1019,7 +1019,7 @@ int kvm_arm_vcpu_arch_has_attr(struct kvm_vcpu *vcpu, 
	return ret;

}



long kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,

int kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,

			       struct kvm_arm_copy_mte_tags *copy_tags)

{

	gpa_t guest_ipa = copy_tags->guest_ipa;
@@ -1041,6 +1041,10 @@ long kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm, 
	if (length & ~PAGE_MASK || guest_ipa & ~PAGE_MASK)

		return -EINVAL;



	/* Lengths above INT_MAX cannot be represented in the return value */

	if (length > INT_MAX)

		return -EINVAL;



	gfn = gpa_to_gfn(guest_ipa);



	mutex_lock(&kvm->slots_lock);