Re: [PATCH v5 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

[Matthew Rosato <mjrosato@linux.ibm.com>]

>> [Severity: Critical]
>> Does this calculation underestimate the true byte footprint of the bit
>> vector
>> when aibvo is non-zero?
>>
>> If a guest provides msi_vecs = 64, aibvo = 63, and an aibv GPA with a
>> page
>> offset of 4081, the calculated size is 15 bytes instead of 16. The npages
>> calculation yields DIV_ROUND_UP(4081 + 15, 4096) = 1, which incorrectly
>> passes the npages > 1 boundary check.
>>
>> This would result in KVM pinning only one page, but the hardware could
>> access
>> the 16th byte, writing to the first byte of the next unpinned host
>> physical
>> page, which could lead to host memory corruption.
> 
> I think Sashiko does have a valid point here (sigh...). The right fix
> would be to correctly round up both msi_vecs and aibvo bits so:
> 
> size = BITS_TO_LONGS(msi_vecs + fib->fmt0.aibvo) * sizeof(unsigned long);
> 
> and remove size += (fib->fmt0.aibvo / 8);
>
Yeah, that sounds right to me.