diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-08-29 07:48:55 +0200 |
|---|---|---|
| committer | Oliver Upton <oupton@kernel.org> | 2026-09-15 15:09:56 -0700 |
| commit | 64dc6f1db7e620f2e9337bb181f305fb0561da79 (patch) | |
| tree | e325d4e8f488c10afe28fa4e2abb204fb75e1756 | |
| parent | 4f16c5fc8dc4c5596e3777ab9f449a54e3f85fd5 (diff) | |
| download | linux-next-64dc6f1db7e620f2e9337bb181f305fb0561da79.tar.gz linux-next-64dc6f1db7e620f2e9337bb181f305fb0561da79.zip | |
KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
kvm_smccc_set_filter() only rejects a range if its inclusive end,
base + nr_functions - 1, is below base. That catches an empty range
(nr_functions == 0) at every nonzero base, but at base 0 the end wraps
to U32_MAX and KVM tries to insert [0, U32_MAX], which overlaps the
reserved Arm Architecture Calls ranges. KVM_ARM_VM_SMCCC_FILTER then
returns -EEXIST instead of the -EINVAL that the smccc_filter selftest
expects for an empty range.
Reject a zero function count explicitly.
Tested with a userspace reproducer on an arm64 VHE host under QEMU TCG:
EEXIST before, EINVAL after.
Fixes: 821d935c87bc ("KVM: arm64: Introduce support for userspace SMCCC filtering")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260829054856.70549-2-kmehltretter@gmail.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
| -rw-r--r-- | arch/arm64/kvm/hypercalls.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/arm64/kvm/hypercalls.c b/arch/arm64/kvm/hypercalls.c index b11b8821c9fb..dfa25bb6f25d 100644 --- a/arch/arm64/kvm/hypercalls.c +++ b/arch/arm64/kvm/hypercalls.c @@ -185,7 +185,8 @@ static int kvm_smccc_set_filter(struct kvm *kvm, struct kvm_smccc_filter __user start = filter.base; end = start + filter.nr_functions - 1; - if (end < start || filter.action >= NR_SMCCC_FILTER_ACTIONS) + if (!filter.nr_functions || end < start || + filter.action >= NR_SMCCC_FILTER_ACTIONS) return -EINVAL; mutex_lock(&kvm->arch.config_lock); |