From: Naman Jain <namjain@linux.microsoft.com>
To: Yi Xie <xieyi@kylinos.cn>,
kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org,
decui@microsoft.com, longli@microsoft.com
Cc: linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler
Date: Thu, 23 Jul 2026 14:37:51 +0530 [thread overview]
Message-ID: <eb6113fc-4fc8-4f28-8dfc-121cf6de5abd@linux.microsoft.com> (raw)
In-Reply-To: <20260709021947.49436-1-xieyi@kylinos.cn>
On 7/9/2026 7:49 AM, Yi Xie wrote:
> cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >=
> nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset.
>
> Signed-off-by: Yi Xie <xieyi@kylinos.cn>
> ---
> drivers/hv/mshv_vtl_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
> index 0d3d4161974f..fc50c44ac1bd 100644
> --- a/drivers/hv/mshv_vtl_main.c
> +++ b/drivers/hv/mshv_vtl_main.c
> @@ -801,7 +801,7 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
> int cpu = vmf->pgoff & MSHV_PG_OFF_CPU_MASK;
> int real_off = vmf->pgoff >> MSHV_REAL_OFF_SHIFT;
>
> - if (!cpu_online(cpu))
> + if (cpu >= nr_cpu_ids || !cpu_online(cpu))
> return VM_FAULT_SIGBUS;
> /*
> * CPU Hotplug is not supported in VTL2 in OpenHCL, where this kernel driver exists.
The problem fixed by this patch generally does not happen in practice as
the user space is trusted user space (OpenVMM). Nevertheless, it's good
to have this check.
Nit: subject - s/"mshv:"/"mshv_vtl:"
as this was the agreed upon prefix for changes to mshv_vtl_main driver.
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
next prev parent reply other threads:[~2026-07-23 9:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-09 2:19 [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler Yi Xie
2026-07-09 2:51 ` sashiko-bot
2026-07-22 22:22 ` Wei Liu
2026-07-23 9:07 ` Naman Jain [this message]
2026-07-23 16:58 ` Wei Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=eb6113fc-4fc8-4f28-8dfc-121cf6de5abd@linux.microsoft.com \
--to=namjain@linux.microsoft.com \
--cc=decui@microsoft.com \
--cc=haiyangz@microsoft.com \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=longli@microsoft.com \
--cc=wei.liu@kernel.org \
--cc=xieyi@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox