Re: [RFC PATCH v2 3/4] KVM: x86: Add optional KVM_EXPORT_MEMORY and KVM_IMPORT_MEMORY

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unvalidated UAPI fields `flags` and `id` in `struct kvm_memory_transfer` can lead to ABI breakage.
--

commit b6f49e80a58eebaaa2a6d123950fd36709972a10
Author: Tony Lindgren <tony.lindgren@linux.intel.com>

KVM: x86: Add optional KVM_EXPORT_MEMORY and KVM_IMPORT_MEMORY

This commit adds support to export and import KVM memory for cases where
the memory is only accessible to the guest. It introduces the optional
KVM_EXPORT_MEMORY and KVM_IMPORT_MEMORY ioctls to assist with live
migration of confidential computing.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 7064fd709e56d..8a99c665008a3 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
[ ... ]
> @@ -7258,6 +7258,37 @@ long kvm_arch_vcpu_unlocked_ioctl(struct file *filp, unsigned int ioctl,
>  	return -ENOIOCTLCMD;
>  }
>  
> +static int kvm_vm_ioctl_transfer_memory(struct kvm *kvm, bool import,
> +					void __user *argp)
> +{
> +	struct kvm_memory_transfer mem;
> +	int r;
> +
> +	if (!kvm_x86_call(cap_live_migration)(kvm) ||
> +	    (import && !kvm_x86_ops.import_memory) ||
> +	    (!import && !kvm_x86_ops.export_memory))
> +		return -ENOTTY;
> +
> +	if (copy_from_user(&mem, argp, sizeof(mem)))
> +		return -EFAULT;
> +
> +	if (mem.reserved || mem.buf.reserved || !mem.nr_gfns)
> +		return -EINVAL;

[Severity: Medium]
Does this input validation for the kvm_memory_transfer UAPI struct miss
checking mem.flags == 0 and mem.id == 0?

Failing to validate that unused UAPI fields are zero allows userspace to pass
uninitialized garbage. If KVM later assigns specific meaning to these fields,
older applications that unintentionally passed non-zero values could break,
leading to an ABI compatibility issue.

Standard Linux UAPI design usually requires enforcing these unused or reserved
fields to be zero for future extensibility.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831071304.762939-1-tony.lindgren@linux.intel.com?part=3