Re: [PATCH v2 2/5] KVM: selftests: memstress: Add option to enable dirty-ring on VM creation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: selftests: missing KVM_MAX_VCPUS bounds check in memstress_vm_create_with_vcpus()
--

commit 8f8ed5a2bb5936b315dc077d1f97ad188346d5a2
Author: Leonardo Bras <leo.bras@arm.com>

KVM: selftests: memstress: Add option to enable dirty-ring on VM creation

This commit adds an option to memstress_create_vm() to take a dirty-ring size
and enables it before vCPU creation. It introduces a new function
memstress_vm_create_with_vcpus() to handle this setup correctly.

> diff --git a/tools/testing/selftests/kvm/lib/memstress.c b/tools/testing/selftests/kvm/lib/memstress.c
> index 880657df65e9e..b1f13499e85f4 100644
> --- a/tools/testing/selftests/kvm/lib/memstress.c
> +++ b/tools/testing/selftests/kvm/lib/memstress.c
> @@ -121,6 +121,27 @@ void memstress_setup_vcpus(struct kvm_vm *vm, int nr_vcpus,

[ ... ]

> +static struct kvm_vm *memstress_vm_create_with_vcpus(struct memstress_params *params,
> +						     u64 extra_mem_pages)
> +{
> +	struct kvm_vm *vm;
> +	int i;
> +
> +	TEST_ASSERT(params->nr_vcpus > 0, "Invalid number of vCPUs (%d)",
> +		    params->nr_vcpus);
> +
> +	vm = __vm_create(VM_SHAPE(params->mode), params->nr_vcpus, extra_mem_pages);
> +
> +	if (params->dirty_ring_size)
> +		vm_enable_dirty_ring(vm, params->dirty_ring_size);
> +
> +	for (i = 0; i < params->nr_vcpus; ++i)

[Severity: High]
Can this loop overflow the statically sized vcpus array?

The vcpus array is bounded by KVM_MAX_VCPUS (512). When a user runs a
memstress-based test with an argument greater than 512 on a host kernel where
KVM_CAP_MAX_VCPUS is greater than 512, or runs mmu_stress_test on a host with
more than ~682 physical cores, the option parser checks against
KVM_CAP_MAX_VCPUS but not against KVM_MAX_VCPUS.

Passing this unbounded params->nr_vcpus value to
memstress_vm_create_with_vcpus() will blindly write past the end of the vcpus
array, causing memory corruption and crashing the selftest.

> +		vcpus[i] = vm_vcpu_add(vm, i, memstress_guest_code);
> +
> +	kvm_arch_vm_finalize_vcpus(vm);
> +	return vm;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009130054.3312154-2-leo.bras@arm.com?part=2