KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()

The footprint calculated for struct hyp_trace_desc sizes only
trace_buffer_desc and do not take into account the other fields. It
worked so far thanks to the follow-up PAGE_ALIGN().

Fix the descriptor size and while at it, enforce an overflow check after
PAGE_ALIGN().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260710114819.2689386-3-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/hyp_trace.c b/arch/arm64/kvm/hyp_trace.c
index aabf2989d70d3d4678f38c8899c88df9ebbfc47c..1adfdc80018766ee7e421cbdbee6e1ea9c7fa274 100644 (file)
--- a/arch/arm64/kvm/hyp_trace.c
+++ b/arch/arm64/kvm/hyp_trace.c
@@ -229,18 +229,22 @@ static int hyp_trace_buffer_share_hyp(struct hyp_trace_buffer *trace_buffer)
 static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)
 {
        struct hyp_trace_buffer *trace_buffer = priv;
+       size_t desc_size, tb_desc_size;
        struct hyp_trace_desc *desc;
-       size_t desc_size;
        int ret;
 
        if (WARN_ON(trace_buffer->desc))
                return ERR_PTR(-EINVAL);
 
-       desc_size = trace_buffer_desc_size(size, num_possible_cpus());
+       tb_desc_size = trace_buffer_desc_size(size, num_possible_cpus());
+       desc_size = size_add(tb_desc_size, offsetof(struct hyp_trace_desc, trace_buffer_desc));
        if (desc_size == SIZE_MAX)
                return ERR_PTR(-E2BIG);
 
        desc_size = PAGE_ALIGN(desc_size);
+       if (!desc_size)
+               return ERR_PTR(-E2BIG);
+
        desc = (struct hyp_trace_desc *)alloc_pages_exact(desc_size, GFP_KERNEL);
        if (!desc)
                return ERR_PTR(-ENOMEM);
@@ -256,7 +260,7 @@ static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)
        if (ret)
                goto err_free_desc;
 
-       ret = trace_remote_alloc_buffer(&desc->trace_buffer_desc, desc_size, size,
+       ret = trace_remote_alloc_buffer(&desc->trace_buffer_desc, tb_desc_size, size,
                                        cpu_possible_mask);
        if (ret)
                goto err_free_backing;