linux-kernel - Re: [PATCH v2] KVM: arm64: Check range args for pKVM mem transitions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aN_TjloudttqBUtf@google.com>
Date: Fri, 3 Oct 2025 14:45:50 +0100
From: Vincent Donnefort <vdonnefort@...gle.com>
To: Marc Zyngier <maz@...nel.org>
Cc: Oliver Upton <oliver.upton@...ux.dev>, joey.gouly@....com,
	suzuki.poulose@....com, yuzenghui@...wei.com,
	catalin.marinas@....com, will@...nel.org, qperret@...gle.com,
	sebastianene@...gle.com, keirf@...gle.com,
	linux-arm-kernel@...ts.infradead.org, kvmarm@...ts.linux.dev,
	linux-kernel@...r.kernel.org, kernel-team@...roid.com
Subject: Re: [PATCH v2] KVM: arm64: Check range args for pKVM mem transitions

[...]

> > > > > > +static bool check_range_args(u64 start, u64 nr_pages, u64 *size)
> > > > > > +{
> > > > > > +	if (check_mul_overflow(nr_pages, PAGE_SIZE, size))
> > > > > > +		return false;
> > > > > > +
> > > > > > +	return start < (start + *size);
> > > > > 
> > > > > I will echo Oliver's concern on v1: you probably want to convert the
> > > > > boundary check to be inclusive of the end of the range. Otherwise, a
> > > > > range that ends at the top of the 64bit range will be represented as
> > > > > 0, and fail the  check despite being perfectly valid.
> > > > 
> > > > Do you mean allowing something like start == 0xfffffffffffff000 and size ==
> > > > 4096?
> > > 
> > > Yes, this is what I was alluding to on v1.
> > > 
> > > > But I guess that would still put all the following checks using "addr + size" at
> > > > risk. Also, I believe even the code in pgtable.c wouldn't support a such range
> > > > as it is also using a u64 end boundary.
> > > 
> > > I'm not sure I follow. Ranges are pretty commonly expressed as a range
> > > terminated by an exclusive value. This just hasn't been an issue yet as
> > > the page table code is only ever dealing with TTBR0 or VTTBR
> > > translations.
> > 
> > If I do exclude the end boundary, evading checks would be as simple as making
> > sure we overflow the end boundary?
> > 
> > e.g. __pkvm_host_share_guest(phys = 0xfffffffffffff000, size = 4096) 
> > 
> >         check_range_allowed_memory(phys, phys + size) /* nop */
> > 	....
> > 	for_each_hyp_page(page, phys, size) {  /* nop */
> >                ...
> > 	} 
> > 	...
> > 	/* Install a valid mapping to phys */
> > 	kvm_pgtable_stage2_map(&vm->pgt, ipa, size, phys, ...) 
> 
> Why shouldn't this be as simple as this:
> 
> static bool check_range_args(u64 start, u64 nr_pages, u64 *size)
> {
> 	if (check_mul_overflow(nr_pages, PAGE_SIZE, size))
> 		return false;
> 
> 	return start < (start + *size - 1);
> }
> 
> which correctly deals with the boundary issue?

I am concerned about allowing ranges that will still overflow "phys + size".

e.g. phys=0xfffffffffffff000 and size=4096 would pass check_range_args().

But in __pkvm_host_share_guest() that would mean:

  bypassing check_range_allowed_memory()
  bypassing for_each_hyp_page()

  but installing a valid mapping to phys with:
   kvm_pgtable_stage2_map(&vm->pgt, ipa, size, phys, ...) 


> 
> 	M.
> 
> -- 
> Without deviation from the norm, progress is not possible.