Re: [RFC PATCH v2 2/4] KVM: x86: Add optional KVM_CAP_LIVE_MIGRATION and KVM_MIGRATE_CMD

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The 'flags' field in the new 'struct kvm_migrate_cmd' UAPI is not validated to be zero.
--

commit b50bc10fe65ad9a54c9b979c445505e5baf76592
Author: Tony Lindgren <tony.lindgren@linux.intel.com>

KVM: x86: Add optional KVM_CAP_LIVE_MIGRATION and KVM_MIGRATE_CMD

This patch introduces the KVM_CAP_LIVE_MIGRATION capability and the
KVM_MIGRATE_CMD ioctl. These additions allow KVM to configure hardware-specific
live migration functions, which is necessary for confidential guests like TDX.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index afcac1042947a..7064fd709e56d 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c

[ ... ]

> @@ -7614,6 +7617,28 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
>  		r = kvm_vm_ioctl_set_msr_filter(kvm, &filter);
>  		break;
>  	}
> +	case KVM_MIGRATE_CMD: {
> +		struct kvm_migrate_cmd cmd;
> +
> +		if (!kvm_x86_ops.migrate_cmd ||
> +		    !kvm_x86_call(cap_live_migration)(kvm))
> +			return -ENOTTY;
> +
> +		if (copy_from_user(&cmd, argp, sizeof(cmd)))
> +			return -EFAULT;
> +
> +		if (cmd.reserved || cmd.buf.reserved)
> +			return -EINVAL;

[Severity: High]
Does this code also need to validate that the new flags field is zero?

If uninitialized memory or garbage is passed by userspace in cmd.flags, it
will currently be silently ignored. When a future kernel introduces a new
flag, old userspace applications passing uninitialized flags will inadvertently
enable it, which could permanently break backwards compatibility.

> +
> +		r = kvm_x86_call(migrate_cmd)(kvm, &cmd);
> +		if (r > 0)
> +			r = -EIO;
> +
> +		/* Copy back also on an error to report a partially done command */
> +		if (copy_to_user(argp, &cmd, sizeof(cmd)))
> +			return -EFAULT;
> +		break;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831071304.762939-1-tony.lindgren@linux.intel.com?part=2