]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
mshv: Fix infinite fault loop on permission-denied GPA intercepts
authorStanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Tue, 24 Mar 2026 23:57:40 +0000 (23:57 +0000)
committerWei Liu <wei.liu@kernel.org>
Sat, 4 Apr 2026 05:25:53 +0000 (05:25 +0000)
commit16cbec24897624051b324aa3a85859c38ca65fde
treeab66f0de1fbc4f76afb42f4f5f4af2fbffdeb156
parentb6422dff0e518245019233432b6bccfc30b73e2f
mshv: Fix infinite fault loop on permission-denied GPA intercepts

Prevent infinite fault loops when guests access memory regions without
proper permissions. Currently, mshv_handle_gpa_intercept() attempts to
remap pages for all faults on movable memory regions, regardless of
whether the access type is permitted. When a guest writes to a read-only
region, the remap succeeds but the region remains read-only, causing
immediate re-fault and spinning the vCPU indefinitely.

Validate intercept access type against region permissions before
attempting remaps. Reject writes to non-writable regions and executes to
non-executable regions early, returning false to let the VMM handle the
intercept appropriately.

This also closes a potential DoS vector where malicious guests could
intentionally trigger these fault loops to consume host resources.

Fixes: b9a66cd5ccbb ("mshv: Add support for movable memory regions")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
drivers/hv/mshv_root_main.c
include/hyperv/hvgdk_mini.h
include/hyperv/hvhdk.h