diff mbox

[v2,1/9] KVM: PPC: Book3S HV: Fix H_REGISTER_VPA VPA size validation

Message ID 20170813013346.14002-1-npiggin@gmail.com
State Accepted
Headers show

Commit Message

Nicholas Piggin Aug. 13, 2017, 1:33 a.m. UTC
KVM currently validates the size of the VPA registered by the client
against sizeof(struct lppaca), however we align (and therefore size)
that struct to 1kB to avoid crossing a 4kB boundary in the client.

PAPR calls for sizes >= 640 bytes to be accepted. Hard code this with
a comment.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 arch/powerpc/kvm/book3s_hv.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Comments

Michael Ellerman Aug. 15, 2017, 11:24 a.m. UTC | #1
Nicholas Piggin <npiggin@gmail.com> writes:

> KVM currently validates the size of the VPA registered by the client
> against sizeof(struct lppaca), however we align (and therefore size)
> that struct to 1kB to avoid crossing a 4kB boundary in the client.
>
> PAPR calls for sizes >= 640 bytes to be accepted. Hard code this with
> a comment.
>
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
>  arch/powerpc/kvm/book3s_hv.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

This one should go via Paul.

Hopefully he can just pick it up.

cheers

> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 359c79cdf0cc..1182cfd79857 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -485,7 +485,13 @@ static unsigned long do_h_register_vpa(struct kvm_vcpu *vcpu,
>  
>  	switch (subfunc) {
>  	case H_VPA_REG_VPA:		/* register VPA */
> -		if (len < sizeof(struct lppaca))
> +		/*
> +		 * The size of our lppaca is 1kB because of the way we align
> +		 * it for the guest to avoid crossing a 4kB boundary. We only
> +		 * use 640 bytes of the structure though, so we should accept
> +		 * clients that set a size of 640.
> +		 */
> +		if (len < 640)
>  			break;
>  		vpap = &tvcpu->arch.vpa;
>  		err = 0;
> -- 
> 2.13.3
--
To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Paul Mackerras Aug. 31, 2017, 3:41 a.m. UTC | #2
On Sun, Aug 13, 2017 at 11:33:38AM +1000, Nicholas Piggin wrote:
> KVM currently validates the size of the VPA registered by the client
> against sizeof(struct lppaca), however we align (and therefore size)
> that struct to 1kB to avoid crossing a 4kB boundary in the client.
> 
> PAPR calls for sizes >= 640 bytes to be accepted. Hard code this with
> a comment.
> 
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

Thanks, patch applied to my kvm-ppc-next branch.

Paul.
--
To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 359c79cdf0cc..1182cfd79857 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -485,7 +485,13 @@  static unsigned long do_h_register_vpa(struct kvm_vcpu *vcpu,
 
 	switch (subfunc) {
 	case H_VPA_REG_VPA:		/* register VPA */
-		if (len < sizeof(struct lppaca))
+		/*
+		 * The size of our lppaca is 1kB because of the way we align
+		 * it for the guest to avoid crossing a 4kB boundary. We only
+		 * use 640 bytes of the structure though, so we should accept
+		 * clients that set a size of 640.
+		 */
+		if (len < 640)
 			break;
 		vpap = &tvcpu->arch.vpa;
 		err = 0;