KVM: arm64: Check range args for pKVM mem transitions

There's currently no verification for host issued ranges in most of the
pKVM memory transitions. The end boundary might therefore be subject to
overflow and later checks could be evaded.

Close this loophole with an additional pfn_range_is_valid() check on a
per public function basis. Once this check has passed, it is safe to
convert pfn and nr_pages into a phys_addr_t and a size.

host_unshare_guest transition is already protected via
__check_host_shared_guest(), while assert_host_shared_guest() callers
are already ignoring host checks.

Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20251016164541.3771235-1-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index ddc8beb55eee6dd6a865e01a513812cf8027a73c..49db32f3ddf7150405943d8e55778b4741bb21c2 100644 (file)
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -367,6 +367,19 @@ static int host_stage2_unmap_dev_all(void)
        return kvm_pgtable_stage2_unmap(pgt, addr, BIT(pgt->ia_bits) - addr);
 }
 
+/*
+ * Ensure the PFN range is contained within PA-range.
+ *
+ * This check is also robust to overflows and is therefore a requirement before
+ * using a pfn/nr_pages pair from an untrusted source.
+ */
+static bool pfn_range_is_valid(u64 pfn, u64 nr_pages)
+{
+       u64 limit = BIT(kvm_phys_shift(&host_mmu.arch.mmu) - PAGE_SHIFT);
+
+       return pfn < limit && ((limit - pfn) >= nr_pages);
+}
+
 struct kvm_mem_range {
        u64 start;
        u64 end;
@@ -776,6 +789,9 @@ int __pkvm_host_donate_hyp(u64 pfn, u64 nr_pages)
        void *virt = __hyp_va(phys);
        int ret;
 
+       if (!pfn_range_is_valid(pfn, nr_pages))
+               return -EINVAL;
+
        host_lock_component();
        hyp_lock_component();
 
@@ -804,6 +820,9 @@ int __pkvm_hyp_donate_host(u64 pfn, u64 nr_pages)
        u64 virt = (u64)__hyp_va(phys);
        int ret;
 
+       if (!pfn_range_is_valid(pfn, nr_pages))
+               return -EINVAL;
+
        host_lock_component();
        hyp_lock_component();
 
@@ -887,6 +906,9 @@ int __pkvm_host_share_ffa(u64 pfn, u64 nr_pages)
        u64 size = PAGE_SIZE * nr_pages;
        int ret;
 
+       if (!pfn_range_is_valid(pfn, nr_pages))
+               return -EINVAL;
+
        host_lock_component();
        ret = __host_check_page_state_range(phys, size, PKVM_PAGE_OWNED);
        if (!ret)
@@ -902,6 +924,9 @@ int __pkvm_host_unshare_ffa(u64 pfn, u64 nr_pages)
        u64 size = PAGE_SIZE * nr_pages;
        int ret;
 
+       if (!pfn_range_is_valid(pfn, nr_pages))
+               return -EINVAL;
+
        host_lock_component();
        ret = __host_check_page_state_range(phys, size, PKVM_PAGE_SHARED_OWNED);
        if (!ret)
@@ -945,6 +970,9 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, u64 nr_pages, struct pkvm_hyp_vcpu
        if (prot & ~KVM_PGTABLE_PROT_RWX)
                return -EINVAL;
 
+       if (!pfn_range_is_valid(pfn, nr_pages))
+               return -EINVAL;
+
        ret = __guest_check_transition_size(phys, ipa, nr_pages, &size);
        if (ret)
                return ret;