Re: [PATCH 1/2] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unprivileged userspace-reachable WARN_ON_ONCE can be triggered by memory pressure, potentially causing a host panic.
--

commit 7eae467c4f77ea62fe7302656a7c43a21cc35eb0
Author: Karl Mehltretter <kmehltretter@gmail.com>

KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0

This commit fixes an issue where an empty SMCCC filter range at base 0
wraps around to U32_MAX, overlapping reserved ranges and incorrectly
returning -EEXIST. It explicitly rejects a zero function count instead.

> diff --git a/arch/arm64/kvm/hypercalls.c b/arch/arm64/kvm/hypercalls.c
> index b11b8821c9fbc..dfa25bb6f25d4 100644
> --- a/arch/arm64/kvm/hypercalls.c
> +++ b/arch/arm64/kvm/hypercalls.c
> @@ -185,7 +185,8 @@ static int kvm_smccc_set_filter(struct kvm *kvm, struct kvm_smccc_filter __user
>  	start = filter.base;
>  	end = start + filter.nr_functions - 1;
>  
> -	if (end < start || filter.action >= NR_SMCCC_FILTER_ACTIONS)
> +	if (!filter.nr_functions || end < start ||
> +	    filter.action >= NR_SMCCC_FILTER_ACTIONS)
>  		return -EINVAL;
>  
>  	mutex_lock(&kvm->arch.config_lock);

[Severity: High]
This isn't a bug introduced by this patch, but while looking at
kvm_smccc_set_filter(), is it possible for an unprivileged user to trigger
a kernel panic via the WARN_ON_ONCE lower down in this function?

A userspace process can call the KVM_ARM_VM_SMCCC_FILTER ioctl, which
requires /dev/kvm access. The kernel calls
kvm_smccc_filter_insert_reserved(), which in turn invokes
mtree_insert_range() with GFP_KERNEL_ACCOUNT.

If this maple tree node allocation fails due to memory pressure or cgroup
limits, it returns -ENOMEM.

The caller kvm_smccc_set_filter() then unconditionally executes the
warning check:

    if (!kvm_smccc_filter_configured(kvm)) {
            r = kvm_smccc_filter_insert_reserved(kvm);
            if (WARN_ON_ONCE(r))
                    goto out_unlock;
    }

Because KVM subsystem guidelines forbid host-userspace-reachable warnings,
could this lead to a host denial-of-service if panic_on_warn is enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260829054856.70549-1-kmehltretter@gmail.com?part=1