Re: [PATCH v5 26/31] KVM: s390: Add basic arm64 kvm module

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Integer underflow in `kvm_max_guest_address()` leading to validation bypass.
- [Low] Missing EXPORT_SYMBOL for `kvm_init_with_dev` causes linker failure for modules.
--

--- Patch [26]: [PATCH v5 26/31] KVM: s390: Add basic arm64 kvm module ---
commit 0b59f30d55223ee112ff6a32812059d6b6bf4d71
Author: Steffen Eiden <[email protected]>

KVM: s390: Add basic arm64 kvm module

This commit adds the basic code and boilerplate for the new arm64 on s390 
KVM implementation. It includes kernel module initialization, tracing 
scaffolding, and initial VCPU interaction functions.

> diff --git a/arch/s390/kvm/arm64/arm.c b/arch/s390/kvm/arm64/arm.c
> new file mode 100644
> index 0000000000000..8e17b7eef8131
> --- /dev/null
> +++ b/arch/s390/kvm/arm64/arm.c

[ ... ]

> +static u64 kvm_max_guest_address(void)
> +{
> +	u64 max_addr;
> +
> +	if (sclp.hamax == U64_MAX)
> +		max_addr = TASK_SIZE_MAX;
> +	else
> +		max_addr = min_t(u64, TASK_SIZE_MAX, sclp.hamax);
> +	return ALIGN_DOWN(max_addr + 1, 1 << 30) - 1;
> +}

[Severity: High]
Does this calculation risk an integer underflow if max_addr + 1 is less than
1GB (1 << 30)?

If the host machine (such as a small LPAR or z/VM guest) has a hardware
absolute memory limit (sclp.hamax) below 1GB minus 1, ALIGN_DOWN() will
return 0. Subtracting 1 from 0 in unsigned 64-bit arithmetic causes an
underflow to U64_MAX.

This underflow propagates to get_kvm_ipa_limit(), turning into an invalid
0xFFFFFFFF limit that bypasses the IPA size check in
kvm_vm_type_ipa_size_shift(). This could allow untrusted user space to
request arbitrarily large IPA sizes, resulting in massive unbounded page
table allocations in gmap_new().

[ ... ]

> +static int __init kvm_s390_arm64_init(void)
> +{
> +	if (!sclp.has_aef)
> +		return -ENXIO;
> +
> +	return kvm_init_with_dev(sizeof(struct kvm_vcpu), 0, THIS_MODULE,
> +				 KVM_DEV_NAME, MISC_DYNAMIC_MINOR);
> +}

[Severity: Low]
Does kvm_init_with_dev() need an EXPORT_SYMBOL or
EXPORT_SYMBOL_FOR_KVM_INTERNAL in virt/kvm/kvm_main.c?

If CONFIG_KVM is built as a loadable module, calling the unexported
kvm_init_with_dev() here will cause an undefined reference linker failure
during kernel compilation.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=26