linux-kernel - Re: [PATCH] arm64: kvm: Fix incorrect VNCR invalidation range calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wm6ezhui.wl-maz@kernel.org>
Date: Thu, 04 Sep 2025 10:29:09 +0100
From: Marc Zyngier <maz@...nel.org>
To: p@...d.pw
Cc: kvmarm@...ts.linux.dev,
	linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	Oliver Upton <oliver.upton@...ux.dev>,
	Joey Gouly <joey.gouly@....com>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Zenghui Yu <yuzenghui@...wei.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>,
	leedongha <gapdev2004@...il.com>
Subject: Re: [PATCH] arm64: kvm: Fix incorrect VNCR invalidation range calculation

On Wed, 03 Sep 2025 13:39:49 +0100,
p@...d.pw wrote:
> 
> From: leedongha <gapdev2004@...il.com>
> 
> The code for invalidating VNCR entries in both kvm_invalidate_vncr_ipa()
> and invalidate_vncr_va() incorrectly uses a bitwise AND with `(size - 1)`
> instead of `~(size - 1)` to align the start address. This results
> in masking the address bits instead of aligning them down to the start
> of the block.
> 
> This bug may cause stale VNCR TLB entries to remain valid even after a
> TLBI or MMU notifier, leading to incorrect memory translation and
> unexpected guest behavior.
> 
> Credit
> Team 0xB6 in bob14:
> DongHa Lee (@GAP-dev)
> Gyujeong Jin (@G1uN4sh)
> Daehyeon Ko (@4ncienth)
> Geonha Lee (@leegn4a)
> Hyungyu Oh (@DQPC_lover)
> Jaewon Yang (@R4mbb1)
> 
> Signed-off-by: leedongha <gapdev2004@...il.com>

The SoB of the person sending the patch is required.

> ---
>  arch/arm64/kvm/nested.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> index 77db81bae86f..d0ddce877b5d 100644
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c
> @@ -847,7 +847,7 @@ static void kvm_invalidate_vncr_ipa(struct kvm *kvm, u64 start, u64 end)
>  
>  		ipa_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,
>  							    vt->wr.level));
> -		ipa_start = vt->wr.pa & (ipa_size - 1);
> +		ipa_start = vt->wr.pa & ~(ipa_size - 1);
>  		ipa_end = ipa_start + ipa_size;
>  
>  		if (ipa_end <= start || ipa_start >= end)
> @@ -887,7 +887,7 @@ static void invalidate_vncr_va(struct kvm *kvm,
>  
>  		va_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,
>  							   vt->wr.level));
> -		va_start = vt->gva & (va_size - 1);
> +		va_start = vt->gva & ~(va_size - 1);
>  		va_end = va_start + va_size;
>  
>  		switch (scope->type) {

Yup, absolutely correct. Thanks a lot for spotting this.
With the above nit addressed:

Reviewed-by: Marc Zyngier <maz@...nel.org>

	M.

-- 
Jazz isn't dead. It just smells funny.