From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C06D6C433EF for ; Sat, 30 Oct 2021 00:08:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ACC556103E for ; Sat, 30 Oct 2021 00:08:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231676AbhJ3ALX (ORCPT ); Fri, 29 Oct 2021 20:11:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231998AbhJ3AK5 (ORCPT ); Fri, 29 Oct 2021 20:10:57 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 42F2AC061227 for ; Fri, 29 Oct 2021 17:08:27 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id b15-20020a25ae8f000000b005c20f367790so2886952ybj.2 for ; Fri, 29 Oct 2021 17:08:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:in-reply-to:message-id:mime-version:references :subject:from:to:cc; bh=7YTOHGbXRx0pd53EDlA19/QLrIOrDD/OrONYgkhDNaY=; b=mJIRSnmWMZ3K5bJb2gYumed0yA8AwHNuP1wn9fwKVtmf73DoT4rBb3mK7Nuuo8b5dt 4UD1yRhEBvJBzLlBS0caGMxENHeQlMZiPVT9Ynrn56n2+c4uLYa6VVp7yA/bkouRIiMf DdbJ7JNykV5fZ4efNbCw4VXcIqboOCbHBdHcPoCw7M50vJdw20kq3KGvBycY4+WIdFaU lpZfKf3rB9qj3klLdWNaql1M5yHLWQsDQ7XyaLZvbqM3h6rIc9Q/hcJmOllXKAm2QMbf l6YXu2FCJkUqGM/ASlp1JizyPSQAyMv1P2FWXEPC7vDsLaESucFmXnh7SPENssI8I15l CqRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:in-reply-to:message-id :mime-version:references:subject:from:to:cc; bh=7YTOHGbXRx0pd53EDlA19/QLrIOrDD/OrONYgkhDNaY=; b=nLcuwbF9vdMd/NdpFfllu34gxAZ1Ds02yAH4q0O16cqhKwu2Nvgs2igHilIbA1l6QW rG66gVDnnAXC9AAOebOjAFwNgt4xJ8LaFivaMOOihHO+4wzaUcP65MoYDPyKF9tTaTuj ymM83WycqmwaI/ymhIhDoV/rjBaL58D5VWMTxZT4L7Btn/HRY5yzBKq53GgcCseGVPTL QNGLKYWtpYUeej29O3mGZ5L80+/6rT9wGjfG1rrF7rOkdIZqJGQTpcj2+NgBcnNPK96d Rv4L9isT1NWh00g0Zkzyb7gxXrhKvUSzzQ7CxSzzvVBmjhn2GPCNVN4fs/K+BQJO19TB Km0w== X-Gm-Message-State: AOAM533BlDP2zSieGIyOawgJ+6bIxQ0oLGl7Bs24fRPOTgowanIEjxTN pfg9WGCy/1rMoAk19EYWRjBHxVvyIEQ= X-Google-Smtp-Source: ABdhPJwOge/x4WwUAfBe4uN0yFwOjxJZLofxDVUmWKRExOA5YnXto3HDG50mi7m3czLysSnezaPvfu89U6I= X-Received: from seanjc798194.pdx.corp.google.com ([2620:15c:90:200:ce6:9e5f:4ab5:a0d2]) (user=seanjc job=sendgmr) by 2002:a25:abe3:: with SMTP id v90mr2400647ybi.315.1635552506473; Fri, 29 Oct 2021 17:08:26 -0700 (PDT) Reply-To: Sean Christopherson Date: Fri, 29 Oct 2021 17:07:59 -0700 In-Reply-To: <20211030000800.3065132-1-seanjc@google.com> Message-Id: <20211030000800.3065132-8-seanjc@google.com> Mime-Version: 1.0 References: <20211030000800.3065132-1-seanjc@google.com> X-Mailer: git-send-email 2.33.1.1089.g2158813163f-goog Subject: [PATCH v2 7/8] KVM: x86: Reject fixeds-size Hyper-V hypercalls with non-zero "var_cnt" From: Sean Christopherson To: Paolo Bonzini , "K. Y. Srinivasan" , Haiyang Zhang , Stephen Hemminger , Wei Liu , Dexuan Cui , Arnd Bergmann Cc: Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org, Ajay Garg Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Reject Hyper-V hypercalls if the guest specifies a non-zero variable size header (var_cnt in KVM) for a hypercall that has a fixed header size. Per the TLFS: It is illegal to specify a non-zero variable header size for a hypercall that is not explicitly documented as accepting variable sized input headers. In such a case the hypercall will result in a return code of HV_STATUS_INVALID_HYPERCALL_INPUT. Signed-off-by: Sean Christopherson --- arch/x86/kvm/hyperv.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index 3d83d6a5d337..ad455df850c9 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -2241,14 +2241,14 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu) switch (hc.code) { case HVCALL_NOTIFY_LONG_SPIN_WAIT: - if (unlikely(hc.rep)) { + if (unlikely(hc.rep || hc.var_cnt)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } kvm_vcpu_on_spin(vcpu, true); break; case HVCALL_SIGNAL_EVENT: - if (unlikely(hc.rep)) { + if (unlikely(hc.rep || hc.var_cnt)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } @@ -2258,7 +2258,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu) fallthrough; /* maybe userspace knows this conn_id */ case HVCALL_POST_MESSAGE: /* don't bother userspace if it has no way to handle it */ - if (unlikely(hc.rep || !to_hv_synic(vcpu)->active)) { + if (unlikely(hc.rep || hc.var_cnt || !to_hv_synic(vcpu)->active)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } @@ -2271,14 +2271,14 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu) kvm_hv_hypercall_complete_userspace; return 0; case HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST: - if (unlikely(!hc.rep_cnt || hc.rep_idx)) { + if (unlikely(!hc.rep_cnt || hc.rep_idx || hc.var_cnt)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } ret = kvm_hv_flush_tlb(vcpu, &hc, false); break; case HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE: - if (unlikely(hc.rep)) { + if (unlikely(hc.rep || hc.var_cnt)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } @@ -2299,7 +2299,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu) ret = kvm_hv_flush_tlb(vcpu, &hc, true); break; case HVCALL_SEND_IPI: - if (unlikely(hc.rep)) { + if (unlikely(hc.rep || hc.var_cnt)) { ret = HV_STATUS_INVALID_HYPERCALL_INPUT; break; } @@ -2331,6 +2331,11 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu) ret = HV_STATUS_OPERATION_DENIED; break; } + if (unlikely(hc.var_cnt)) { + ret = HV_STATUS_INVALID_HYPERCALL_INPUT; + break; + } + vcpu->run->exit_reason = KVM_EXIT_HYPERV; vcpu->run->hyperv.type = KVM_EXIT_HYPERV_HCALL; vcpu->run->hyperv.u.hcall.input = hc.param; -- 2.33.1.1089.g2158813163f-goog