* [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler
@ 2026-07-09 2:19 Yi Xie
2026-07-22 22:22 ` Wei Liu
2026-07-23 9:07 ` Naman Jain
0 siblings, 2 replies; 3+ messages in thread
From: Yi Xie @ 2026-07-09 2:19 UTC (permalink / raw)
To: kys, haiyangz, wei.liu, decui, longli; +Cc: linux-hyperv, linux-kernel, Yi Xie
cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >=
nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset.
Signed-off-by: Yi Xie <xieyi@kylinos.cn>
---
drivers/hv/mshv_vtl_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
index 0d3d4161974f..fc50c44ac1bd 100644
--- a/drivers/hv/mshv_vtl_main.c
+++ b/drivers/hv/mshv_vtl_main.c
@@ -801,7 +801,7 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
int cpu = vmf->pgoff & MSHV_PG_OFF_CPU_MASK;
int real_off = vmf->pgoff >> MSHV_REAL_OFF_SHIFT;
- if (!cpu_online(cpu))
+ if (cpu >= nr_cpu_ids || !cpu_online(cpu))
return VM_FAULT_SIGBUS;
/*
* CPU Hotplug is not supported in VTL2 in OpenHCL, where this kernel driver exists.
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler
2026-07-09 2:19 [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler Yi Xie
@ 2026-07-22 22:22 ` Wei Liu
2026-07-23 9:07 ` Naman Jain
1 sibling, 0 replies; 3+ messages in thread
From: Wei Liu @ 2026-07-22 22:22 UTC (permalink / raw)
To: Yi Xie, ssengar, namjain
Cc: kys, haiyangz, wei.liu, decui, longli, linux-hyperv, linux-kernel
Naman, Saurabh, please review this.
On Thu, Jul 09, 2026 at 10:19:47AM +0800, Yi Xie wrote:
> cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >=
> nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset.
>
> Signed-off-by: Yi Xie <xieyi@kylinos.cn>
> ---
> drivers/hv/mshv_vtl_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
> index 0d3d4161974f..fc50c44ac1bd 100644
> --- a/drivers/hv/mshv_vtl_main.c
> +++ b/drivers/hv/mshv_vtl_main.c
> @@ -801,7 +801,7 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
> int cpu = vmf->pgoff & MSHV_PG_OFF_CPU_MASK;
> int real_off = vmf->pgoff >> MSHV_REAL_OFF_SHIFT;
>
> - if (!cpu_online(cpu))
> + if (cpu >= nr_cpu_ids || !cpu_online(cpu))
> return VM_FAULT_SIGBUS;
> /*
> * CPU Hotplug is not supported in VTL2 in OpenHCL, where this kernel driver exists.
> --
> 2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler
2026-07-09 2:19 [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler Yi Xie
2026-07-22 22:22 ` Wei Liu
@ 2026-07-23 9:07 ` Naman Jain
1 sibling, 0 replies; 3+ messages in thread
From: Naman Jain @ 2026-07-23 9:07 UTC (permalink / raw)
To: Yi Xie, kys, haiyangz, wei.liu, decui, longli; +Cc: linux-hyperv, linux-kernel
On 7/9/2026 7:49 AM, Yi Xie wrote:
> cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >=
> nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset.
>
> Signed-off-by: Yi Xie <xieyi@kylinos.cn>
> ---
> drivers/hv/mshv_vtl_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
> index 0d3d4161974f..fc50c44ac1bd 100644
> --- a/drivers/hv/mshv_vtl_main.c
> +++ b/drivers/hv/mshv_vtl_main.c
> @@ -801,7 +801,7 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
> int cpu = vmf->pgoff & MSHV_PG_OFF_CPU_MASK;
> int real_off = vmf->pgoff >> MSHV_REAL_OFF_SHIFT;
>
> - if (!cpu_online(cpu))
> + if (cpu >= nr_cpu_ids || !cpu_online(cpu))
> return VM_FAULT_SIGBUS;
> /*
> * CPU Hotplug is not supported in VTL2 in OpenHCL, where this kernel driver exists.
The problem fixed by this patch generally does not happen in practice as
the user space is trusted user space (OpenVMM). Nevertheless, it's good
to have this check.
Nit: subject - s/"mshv:"/"mshv_vtl:"
as this was the agreed upon prefix for changes to mshv_vtl_main driver.
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-23 9:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 2:19 [PATCH] mshv: bounds-check cpu index in vtl mmap fault handler Yi Xie
2026-07-22 22:22 ` Wei Liu
2026-07-23 9:07 ` Naman Jain
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox