Commit f71f7afd authored by Vincent Donnefort's avatar Vincent Donnefort Committed by Marc Zyngier
Browse files

KVM: arm64: Check range args for pKVM mem transitions 



There's currently no verification for host issued ranges in most of the
pKVM memory transitions. The end boundary might therefore be subject to
overflow and later checks could be evaded.

Close this loophole with an additional pfn_range_is_valid() check on a
per public function basis. Once this check has passed, it is safe to
convert pfn and nr_pages into a phys_addr_t and a size.

host_unshare_guest transition is already protected via
__check_host_shared_guest(), while assert_host_shared_guest() callers
are already ignoring host checks.

Signed-off-by: default avatarVincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20251016164541.3771235-1-vdonnefort@google.com


Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
parent a186fbcf

arch/arm64/kvm/hyp/nvhe/mem_protect.c

+28 −0
Original line number Diff line number Diff line
@@ -367,6 +367,19 @@ static int host_stage2_unmap_dev_all(void) 
	return kvm_pgtable_stage2_unmap(pgt, addr, BIT(pgt->ia_bits) - addr);

}



/*

 * Ensure the PFN range is contained within PA-range.

 *

 * This check is also robust to overflows and is therefore a requirement before

 * using a pfn/nr_pages pair from an untrusted source.

 */

static bool pfn_range_is_valid(u64 pfn, u64 nr_pages)

{

	u64 limit = BIT(kvm_phys_shift(&host_mmu.arch.mmu) - PAGE_SHIFT);



	return pfn < limit && ((limit - pfn) >= nr_pages);

}



struct kvm_mem_range {

	u64 start;

	u64 end;
@@ -776,6 +789,9 @@ int __pkvm_host_donate_hyp(u64 pfn, u64 nr_pages) 
	void *virt = __hyp_va(phys);

	int ret;



	if (!pfn_range_is_valid(pfn, nr_pages))

		return -EINVAL;



	host_lock_component();

	hyp_lock_component();
@@ -804,6 +820,9 @@ int __pkvm_hyp_donate_host(u64 pfn, u64 nr_pages) 
	u64 virt = (u64)__hyp_va(phys);

	int ret;



	if (!pfn_range_is_valid(pfn, nr_pages))

		return -EINVAL;



	host_lock_component();

	hyp_lock_component();
@@ -887,6 +906,9 @@ int __pkvm_host_share_ffa(u64 pfn, u64 nr_pages) 
	u64 size = PAGE_SIZE * nr_pages;

	int ret;



	if (!pfn_range_is_valid(pfn, nr_pages))

		return -EINVAL;



	host_lock_component();

	ret = __host_check_page_state_range(phys, size, PKVM_PAGE_OWNED);

	if (!ret)
@@ -902,6 +924,9 @@ int __pkvm_host_unshare_ffa(u64 pfn, u64 nr_pages) 
	u64 size = PAGE_SIZE * nr_pages;

	int ret;



	if (!pfn_range_is_valid(pfn, nr_pages))

		return -EINVAL;



	host_lock_component();

	ret = __host_check_page_state_range(phys, size, PKVM_PAGE_SHARED_OWNED);

	if (!ret)
@@ -945,6 +970,9 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, u64 nr_pages, struct pkvm_hyp_vcpu 
	if (prot & ~KVM_PGTABLE_PROT_RWX)

		return -EINVAL;



	if (!pfn_range_is_valid(pfn, nr_pages))

		return -EINVAL;



	ret = __guest_check_transition_size(phys, ipa, nr_pages, &size);

	if (ret)

		return ret;