diff options
| author | Fuad Tabba <fuad.tabba@linux.dev> | 2026-08-25 09:59:45 +0100 |
|---|---|---|
| committer | Oliver Upton <oupton@kernel.org> | 2026-09-15 15:09:56 -0700 |
| commit | 2a2eb10795a1e495aebc7f829ccecb72c05b4fd9 (patch) | |
| tree | c01e3f29d7c83ff3d31732aa37c5d7471910d5f1 | |
| parent | 4c74e233cdedd11592775fae2a6243e67ca3f891 (diff) | |
| download | linux-next-2a2eb10795a1e495aebc7f829ccecb72c05b4fd9.tar.gz linux-next-2a2eb10795a1e495aebc7f829ccecb72c05b4fd9.zip | |
KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided
sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()
and the WARN_ON() there, which is fatal at EL2. The existing
!sve_state_size test rejects such a length, but only after the macro has
run.
Check sve_vl_valid() before deriving the state size. A valid length
cannot yield a zero size, so the !sve_state_size test goes with it.
Fixes: 5db1bef93342 ("KVM: arm64: Track SVE state in the hypervisor vcpu structure")
Reported-by: Stefan Teodorescu <fane@google.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260825085948.1674721-2-fuad.tabba@linux.dev
Signed-off-by: Oliver Upton <oupton@kernel.org>
| -rw-r--r-- | arch/arm64/kvm/hyp/nvhe/pkvm.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c index 459bd9eb7e4b..627f13fc98d4 100644 --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c @@ -459,14 +459,15 @@ static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *h /* Limit guest vector length to the maximum supported by the host. */ sve_max_vl = min(READ_ONCE(host_vcpu->arch.sve_max_vl), kvm_host_sve_max_vl); - sve_state_size = sve_state_size_from_vl(sve_max_vl); sve_state = kern_hyp_va(READ_ONCE(host_vcpu->arch.sve_state)); - if (!sve_state || !sve_state_size) { + if (!sve_vl_valid(sve_max_vl) || !sve_state) { ret = -EINVAL; goto err; } + sve_state_size = sve_state_size_from_vl(sve_max_vl); + ret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size); if (ret) goto err; |