Re: [RFC 3/3] KVM: PPC: Book3S HV nestedv2: cap max vcpus to PAPR limit

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] Build failure on non-HV configurations (e.g. BookE or PR-only builds) due to undeclared identifier KVM_MAX_VCPU_IDS_NESTEDv2.

Pre-existing issues:
- [High] The patch correctly caps the reported KVM capabilities for nestedv2 maximum vCPUs and vCPU IDs to 2048, but it fails to enforce this limit during actual vCPU creation. A malicious userspace can bypass the capability check and pass a vcpu_id >= 2048, causing the L0 hypervisor to reject it and triggering an unbounded pr_err() log spam in the host kernel.
--

commit 603e4503cd207cc17d84e5e865ff47b744a57762
Author: Ritesh Harjani (IBM) <ritesh.list@gmail.com>

KVM: PPC: Book3S HV nestedv2: cap max vcpus to PAPR limit

This commit limits the maximum number of vCPUs and vCPU IDs reported by KVM
for nestedv2 guests to 2048, as dictated by the PAPR specification. It updates
KVM_CAP_NR_VCPUS, KVM_CAP_MAX_VCPUS, and KVM_CAP_MAX_VCPU_ID when
kvmhv_is_nestedv2() is true.

> diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
> index 2d139c8075773..d48232557259c 100644
> --- a/arch/powerpc/include/asm/kvm_host.h
> +++ b/arch/powerpc/include/asm/kvm_host.h
> @@ -37,6 +37,7 @@
>  #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
>  #include <asm/kvm_book3s_asm.h>		/* for MAX_SMT_THREADS */
>  #define KVM_MAX_VCPU_IDS	(MAX_SMT_THREADS * KVM_MAX_VCORES)
> +#define KVM_MAX_VCPU_IDS_NESTEDv2	2048	/* PAPR H_GUEST_CREATE_VCPU vcpuId */
>  
>  /*
>   * Limit the nested partition table to 4096 entries (because that's what
> diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
> index 9194cf492d1ca..cf620b6534de6 100644
> --- a/arch/powerpc/kvm/powerpc.c
> +++ b/arch/powerpc/kvm/powerpc.c
> @@ -663,12 +663,18 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
>  			r = min(num_present_cpus(), KVM_MAX_VCPUS);
>  		else
>  			r = min(num_online_cpus(), KVM_MAX_VCPUS);
> +		if (kvmhv_is_nestedv2())
> +			r = min(r, KVM_MAX_VCPU_IDS_NESTEDv2);

[Severity: Low]
Will this cause a build failure on non-HV configurations?

Since KVM_MAX_VCPU_IDS_NESTEDv2 is defined inside an
#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE block in asm/kvm_host.h, but the
KVM_CAP_NR_VCPUS case in kvm_vm_ioctl_check_extension() sits outside of that
#ifdef block, using it unconditionally here could result in an undeclared
identifier error for builds without HV support (like BookE or PR-only).

>  		break;
>  	case KVM_CAP_MAX_VCPUS:
>  		r = KVM_MAX_VCPUS;
> +		if (kvmhv_is_nestedv2())
> +			r = min(r, KVM_MAX_VCPU_IDS_NESTEDv2);
>  		break;
>  	case KVM_CAP_MAX_VCPU_ID:
>  		r = KVM_MAX_VCPU_IDS;
> +		if (kvmhv_is_nestedv2())
> +			r = min(r, KVM_MAX_VCPU_IDS_NESTEDv2);

[Severity: High]
This is a pre-existing issue, but does capping the reported capability prevent
userspace from actually creating vCPUs with IDs >= 2048?

While this patch fixes the capability reporting, a malicious userspace process
can still bypass the capability check and pass a vcpu_id >= 2048 to the
KVM_CREATE_VCPU ioctl.

If this happens, it appears kvm_arch_vcpu_precreate() in
arch/powerpc/kvm/powerpc.c will still allow it:

int kvm_arch_vcpu_precreate(struct kvm *kvm, unsigned int id)
{
	return 0;
}

This could cause the L0 hypervisor to reject it in
kvmhv_nestedv2_vcpu_create() in arch/powerpc/kvm/book3s_hv_nestedv2.c, which
contains an unratelimited pr_err() log:

	rc = plpar_guest_create_vcpu(0, vcpu->kvm->arch.lpid, vcpu->vcpu_id);

	if (rc != H_SUCCESS) {
		pr_err("KVM: Create Guest vcpu hcall failed, rc=%ld\n", rc);

Could this be used by an unprivileged host user with /dev/kvm access to
trigger an unbounded log spam and cause a local Denial of Service (DoS)?
Should architecture-specific bounds checking be added to
kvm_arch_vcpu_precreate() to reject vcpu_ids >= KVM_MAX_VCPU_IDS_NESTEDv2
before proceeding with vCPU creation?

>  		break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1789099725.git.ritesh.list@gmail.com?part=3