[PATCH v4 16/17] KVM: arm64: Reject hyp trace descriptors with fewer than 3 pages
Vincent Donnefort <[email protected]> Fri, 31 Jul 2026 15:35:40 +0100
| Newsgroups | dev.linux.lists.kvmarm,org.infradead.lists.linux-arm-kernel |
|---|---|
| Message-ID | <[email protected]> |
A trace descriptor with 0 nr_page_va allocates a 0-size bpages backing region, which makes the ring buffer appear unloaded. Reject descriptors with nr_page_va < 3 in hyp_trace_desc_is_valid() as this is in any case the lower-limit for simple_ring_buffer. Tested-by: Fuad Tabba <[email protected]> Signed-off-by: Vincent Donnefort <[email protected]> diff --git a/arch/arm64/kvm/hyp/nvhe/trace.c b/arch/arm64/kvm/hyp/nvhe/trace.c index 6e716295247a..96afa3d6de2f 100644 --- a/arch/arm64/kvm/hyp/nvhe/trace.c +++ b/arch/arm64/kvm/hyp/nvhe/trace.c @@ -189,6 +189,10 @@ static bool hyp_trace_desc_is_valid(struct hyp_trace_desc *desc, size_t desc_siz if ((void *)rb_desc + struct_size(rb_desc, page_va, 0) > desc_end) return false; + /* simple_ring_buffer_init_mm() expects at least 3 pages */ + if (rb_desc->nr_page_va < 3) + return false; + /* Overflow desc? */ if ((void *)rb_desc + struct_size(rb_desc, page_va, rb_desc->nr_page_va) > desc_end) return false; -- 2.55.0.508.g3f0d502094-goog