]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
authorMostafa Saleh <smostafa@google.com>
Wed, 3 Jun 2026 11:05:21 +0000 (11:05 +0000)
committerWill Deacon <will@kernel.org>
Fri, 17 Jul 2026 17:49:12 +0000 (18:49 +0100)
Sashiko (locally) reports a logical issues in mmio_guard_ioremap_hook()

mmio_guard_ioremap_hook() attempts to handle unaligned addresses and
sizes. However, aligning the start address before adding the size, might
shift the end to the page before.

Fixes: 0f1269495800 ("drivers/virt: pkvm: Intercept ioremap using pKVM MMIO_GUARD hypercall")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c

index 4230b817a80bd814c0ae467c70aa2456dd9b7679..d66291def0f40827fcb3c76da30a4c77a76c4323 100644 (file)
@@ -82,8 +82,8 @@ static int mmio_guard_ioremap_hook(phys_addr_t phys, size_t size,
        if (protval != PROT_DEVICE_nGnRE && protval != PROT_DEVICE_nGnRnE)
                return 0;
 
+       end = PAGE_ALIGN(phys + size);
        phys = PAGE_ALIGN_DOWN(phys);
-       end = phys + PAGE_ALIGN(size);
 
        while (phys < end) {
                const int func_id = ARM_SMCCC_VENDOR_HYP_KVM_MMIO_GUARD_FUNC_ID;