From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2CA8F3FBB67 for ; Wed, 5 Aug 2026 09:39:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922746; cv=none; b=LSi/0PHuzrlO8NfRVR5oavLgbCpm+pfMCg4F3rwTji/Rf/NeHZWOlUA96cNJle7VInG1QeTf141SM0u0Tk0+vszZpNUMfcoSItFewbAgVKcnsUDQaoXzHBgLKCWLrOhnKaJVQsGcksVyvnqR6IePVpR36q0af243E7YAFVDce6M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922746; c=relaxed/simple; bh=43nIU2EkqeEwkSPw2nRlklzH3Ir/5IlnjdHXbjU4Dts=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=KyJSW+b/6DeKQ2Xg0tBPKvQCaZ+3jtWudeAbEUpVIGY76rnAAFVpjXAoH4bN8bZbOt9xQOchPXYN4tMHPr/mh1pYdT9yjQaUsANYKm6bpe9ZHRgXpJb4G3OTSPxBISmIvoBdZ5ggZDB8zXddCjhsJvpIK5DN465dlqxGXufr5LA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=HKh4IXIv; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="HKh4IXIv" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785922741; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rPDR+Ax2mjvgE26rYgUW+aQnYDPjJl0AyLsMcbzCS2k=; b=HKh4IXIvqrrAd7KFVo/dSmdjPRRZMObTmeFaKbo5EMkOmXXM+1o86Ee0aN/gyM/SzcPAnJ q68WWH/Xtvr3kpy/Mgn/KTFGjaWSu8EuI7GlcrwH4K1bz/0GzWHXWB1yrd3u9f935NnRB0 jrFbV/x1AQD13RPGtMysx7Wje4vSNXM= From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/3] KVM: arm64: vgic-its: Don't write past the end of the collection table Date: Wed, 5 Aug 2026 10:38:28 +0100 Message-Id: <20260805093828.3626610-4-fuad.tabba@linux.dev> In-Reply-To: <20260805093828.3626610-1-fuad.tabba@linux.dev> References: <20260805093828.3626610-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT vgic_its_save_collection_table() computes max_size but uses it only to decide whether to append a terminator, leaving the walk over its->collection_list unbounded. A guest that disables the ITS and rewrites GITS_BASER with fewer pages, VALID still set, keeps every collection it mapped against the larger table, because KVM stores the new BASER unconditionally and frees the list only when VALID is cleared. A save then writes up to 448K past the end of the table. The writes stay in guest memory, as vgic_write_guest_lock() validates every gfn, so the guest only corrupts itself. Stop at the boundary regardless and return -EINVAL, which is what vgic_its_save_device_tables() returns when a device falls outside its own table. -ENOSPC describes the condition better, but -EINVAL is already in the error set documented for KVM_DEV_ARM_VGIC_GRP_CTRL, and -ENOSPC is not. Fixes: ea1ad53e1e31a ("KVM: arm64: vgic-its: Collection table save/restore") Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-its.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index ed281fbf008b9..c709fc5e17cda 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2540,6 +2540,9 @@ static int vgic_its_save_collection_table(struct vgic_its *its) max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; list_for_each_entry(collection, &its->collection_list, coll_list) { + if (filled == max_size) + return -EINVAL; + ret = vgic_its_save_cte(its, collection, gpa); if (ret) return ret; -- 2.39.5