Re: [PATCH 3/3] KVM: arm64: vgic-its: Don't write past the end of the collection table

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] vgic_its_save_collection_table() saves collections with IDs that exceed the current GITS_BASER size, generating an invalid migration state that fails on restore.
--

--- Patch [3]: [PATCH 3/3] KVM: arm64: vgic-its: Don't write past the end of the collection table ---
commit d0eca2d07d6d3c4d13e7fff1329f9d14363bb0f5
Author: Fuad Tabba <fuad.tabba@linux.dev>

KVM: arm64: vgic-its: Don't write past the end of the collection table

This commit limits the number of collection table entries saved during
migration to avoid writing past the end of the guest memory table. It
aborts the save operation with -EINVAL if the guest has mapped more
collections than fit in the current table.

> diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
> index ed281fbf008b9..c709fc5e17cda 100644
> --- a/arch/arm64/kvm/vgic/vgic-its.c
> +++ b/arch/arm64/kvm/vgic/vgic-its.c
> @@ -2540,6 +2540,9 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
>  	max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
>  
>  	list_for_each_entry(collection, &its->collection_list, coll_list) {
> +		if (filled == max_size)
> +			return -EINVAL;
> +
>  		ret = vgic_its_save_cte(its, collection, gpa);

[Severity: Medium]
This is a pre-existing issue, but does this code save collections with IDs
that exceed the current GITS_BASER size?

If a guest maps a collection with a large ID, and then shrinks the table size
in GITS_BASER while keeping VALID=1, the collection list isn't freed. Since
the total number of mapped collections might still be small enough to pass the
filled == max_size check, it appears the collection with the large ID will
be successfully saved here.

On the destination side, when vgic_its_restore_cte() reads this entry, it
calls vgic_its_check_id() which checks the ID against the shrunken boundaries,
returning -EINVAL and failing the migration.

Should this path also validate the collection ID against the current table
size, similar to how vgic_its_save_device_tables() uses vgic_its_check_id()?

>  		if (ret)
>  			return ret;
>  		gpa += cte_esz;
>  		filled += cte_esz;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805093828.3626610-1-fuad.tabba@linux.dev?part=3