Re: [PATCH] KVM: x86/hyperv: Explicitly reject VP Assist Page reads if cache was clobbered

[Vitaly Kuznetsov]

Sean Christopherson <seanjc@xxxxxxxxxx> writes:

> Don't try to read the VP Assist Page if the shared PV EOI cache has been
> reconfigured via KVM's actual PV EOI MSR, as trying to read 624 bytes of
> info when the cache is setup for only 1 byte will trip the sanity check
> WARN in kvm_read_guest_offset_cached().  Ideally, KVM wouldn't use shared
> state to track the VP Assist Page, but in practice no sane guest enables
> both KVM's PV EOI and Hyper-V's Assist Page at different addresses, i.e.
> not allowing both to co-exist independently is "fine".
>
> Fixes: b63cf42fd1d8 ("kvm/x86: implement hv EOI assist")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@xxxxxxxx>
> Closes: https://lore.kernel.org/all/20261017093016.32348-7-amirmohammad.eftekhar@xxxxxxxx
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>

Reviewed-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>

(I am, however, thinking it would be better in the long term to either
separate KVM PV / Hyper-V PV state here or even consider a 'big
hammer' and make these two (+Xen?) mutually exclusive for all PV
features.)

> ---
>  arch/x86/kvm/hyperv.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
> index 5d2e3617c952..c08eeaac8bb7 100644
> --- a/arch/x86/kvm/hyperv.c
> +++ b/arch/x86/kvm/hyperv.c
> @@ -949,6 +949,15 @@ int kvm_hv_get_assist_page(struct kvm_vcpu *vcpu)
>  	if (!hv_vcpu || !kvm_hv_assist_page_enabled(vcpu))
>  		return -EFAULT;
>  
> +	/*
> +	 * KVM reuses its own PV EOI feature to emulate Hyper-V's EOI Assist,
> +	 * and rather stupidly reuses the same MSR and cache storage.  Treat
> +	 * the assist page as inaccessible if the shared state is configured
> +	 * only for PV EOI's single byte of data.
> +	 */
> +	if (vcpu->arch.pv_eoi.data.len < sizeof(struct hv_vp_assist_page))
> +		return -EFAULT;
> +
>  	return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data,
>  				     &hv_vcpu->vp_assist_page, sizeof(struct hv_vp_assist_page));
>  }
>
> base-commit: 814607cd40df80d5727957adaa857e0feca43497

-- 
Vitaly