mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

KVM/arm64 fixes for 6.9, part #2

Browse source 
- Fix + test for a NULL dereference resulting from unsanitised user
   input in the vgic-v2 device attribute accessors
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYIADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCZilbBhccb2xpdmVyLnVw
 dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFoIDAQDd28yg55iX18Ad/3zfAMdWgdNz
 NPeicTshy6xeADWTuAEAvRF7KBaC5YQQI8NeWSVd0AYJ63DkF9pzXR9dgY0iQgE=
 =VHCP
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-6.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.9, part #2

- Fix + test for a NULL dereference resulting from unsanitised user
  input in the vgic-v2 device attribute accessors
This commit is contained in:
Paolo Bonzini 2024-04-30 13:50:55 -04:00
commit 16c20208b9
2 changed files with 53 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

8
arch/arm64/kvm/vgic/vgic-kvm-device.c
View file

@ -338,12 +338,12 @@ int kvm_register_vgic_device(unsigned long type)
int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr, int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr,
struct vgic_reg_attr *reg_attr) struct vgic_reg_attr *reg_attr)
{ {
int cpuid; int cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
reg_attr->addr = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK; reg_attr->addr = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK;
reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
if (!reg_attr->vcpu)
return -EINVAL;
return 0; return 0;
} }

49
tools/testing/selftests/kvm/aarch64/vgic_init.c
View file

@ -84,6 +84,18 @@ static struct vm_gic vm_gic_create_with_vcpus(uint32_t gic_dev_type,
return v; return v;
} }
static struct vm_gic vm_gic_create_barebones(uint32_t gic_dev_type)
{
struct vm_gic v;
v.gic_dev_type = gic_dev_type;
v.vm = vm_create_barebones();
v.gic_fd = kvm_create_device(v.vm, gic_dev_type);
return v;
}
static void vm_gic_destroy(struct vm_gic *v) static void vm_gic_destroy(struct vm_gic *v)
{ {
close(v->gic_fd); close(v->gic_fd);
@ -357,6 +369,40 @@ static void test_vcpus_then_vgic(uint32_t gic_dev_type)
vm_gic_destroy(&v); vm_gic_destroy(&v);
} }
#define KVM_VGIC_V2_ATTR(offset, cpu) \
(FIELD_PREP(KVM_DEV_ARM_VGIC_OFFSET_MASK, offset) | \
FIELD_PREP(KVM_DEV_ARM_VGIC_CPUID_MASK, cpu))
#define GIC_CPU_CTRL 0x00
static void test_v2_uaccess_cpuif_no_vcpus(void)
{
struct vm_gic v;
u64 val = 0;
int ret;
v = vm_gic_create_barebones(KVM_DEV_TYPE_ARM_VGIC_V2);
subtest_dist_rdist(&v);
ret = __kvm_has_device_attr(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0));
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
ret = __kvm_device_attr_get(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
ret = __kvm_device_attr_set(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
vm_gic_destroy(&v);
}
static void test_v3_new_redist_regions(void) static void test_v3_new_redist_regions(void)
{ {
struct kvm_vcpu *vcpus[NR_VCPUS]; struct kvm_vcpu *vcpus[NR_VCPUS];
@ -675,6 +721,9 @@ void run_tests(uint32_t gic_dev_type)
test_vcpus_then_vgic(gic_dev_type); test_vcpus_then_vgic(gic_dev_type);
test_vgic_then_vcpus(gic_dev_type); test_vgic_then_vcpus(gic_dev_type);
if (VGIC_DEV_IS_V2(gic_dev_type))
test_v2_uaccess_cpuif_no_vcpus();
if (VGIC_DEV_IS_V3(gic_dev_type)) { if (VGIC_DEV_IS_V3(gic_dev_type)) {
test_v3_new_redist_regions(); test_v3_new_redist_regions();
test_v3_typer_accesses(); test_v3_typer_accesses();