github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index

Browse Source 
The remaining users of the shared indices can't cause a bad memory
access with the channels a CoCo VM accepts today, but an out-of-range
index gives them a nonsense byte count. Give them defined behavior
instead.

hv_pkt_iter_first() bounds its memcpy() by hv_pkt_iter_avail(), which
is derived from write_index, and by pkt_buffer_size, which comes from
max_pkt_size and can exceed ring_datasize. A bad write index can then
make it read past the end of the ring. Only KVP has such a max_pkt_size
(16K on a 12K ring with 4K pages), and vmbus_is_valid_offer() rejects
it in isolated VMs, so this is latent. hv_pkt_iter_avail() now reports
an empty ring for a bad write index and logs it, rate-limited like
hv_ringbuffer_write(). It takes the channel instead of the ring so the
message can include the relid.

hv_get_bytes_to_read() and hv_get_bytes_to_write() now return 0 for a
bad index, so callers see nothing to read and no room to write. This
also stops hv_end_read() from reporting data that hv_pkt_iter_first()
won't return, which would keep a channel rescheduling its callback.

hv_pkt_iter_close() only uses the indices to decide whether to signal
the host, so skip the signal if either is out of range.

Signed-off-by: Kameron Carr <kameroncarr@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
This commit is contained in:
Kameron Carr 2026-10-19 16:09:49 -07:00 committed by Wei Liu
parent a8e60890cb
commit be0d83e869
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/hv/ring_buffer.c
View File

@ -408,8 +408,9 @@ int hv_ringbuffer_read(struct vmbus_channel *channel,
* This is similar to hv_get_bytes_to_read but with private
* read index instead.
*/
static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi)
static u32 hv_pkt_iter_avail(const struct vmbus_channel *channel)
{
const struct hv_ring_buffer_info *rbi = &channel->inbound;
u32 priv_read_loc = rbi->priv_read_index;
u32 write_loc;
@ -421,6 +422,13 @@ static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi)
* stale data.
*/
write_loc = virt_load_acquire(&rbi->ring_buffer->write_index);
if (unlikely(hv_ringbuffer_indices_invalid(rbi, priv_read_loc,
write_loc))) {
pr_err_ratelimited("inbound write index out of range: relid %u write %u size %u\n",
channel->offermsg.child_relid, write_loc,
rbi->ring_datasize);
return 0;
}
return hv_ringbuffer_avail_read(rbi, priv_read_loc, write_loc);
}
@ -438,7 +446,7 @@ struct vmpacket_descriptor *hv_pkt_iter_first(struct vmbus_channel *channel)
hv_debug_delay_test(channel, MESSAGE_DELAY);
bytes_avail = hv_pkt_iter_avail(rbi);
bytes_avail = hv_pkt_iter_avail(channel);
if (bytes_avail < sizeof(struct vmpacket_descriptor))
return NULL;
bytes_avail = min(rbi->pkt_buffer_size, bytes_avail);
@ -587,6 +595,10 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
*/
virt_rmb();
write_index = READ_ONCE(rbi->ring_buffer->write_index);
if (unlikely(hv_ringbuffer_indices_invalid(rbi, start_read_index,
write_index)))
return;
curr_write_sz = hv_ringbuffer_avail_write(rbi, rbi->priv_read_index,
write_index);
bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);

4
include/linux/hyperv.h
View File

@ -250,6 +250,8 @@ static inline u32 hv_get_bytes_to_read(const struct hv_ring_buffer_info *rbi)
read_loc = READ_ONCE(rbi->ring_buffer->read_index);
write_loc = READ_ONCE(rbi->ring_buffer->write_index);
if (unlikely(hv_ringbuffer_indices_invalid(rbi, read_loc, write_loc)))
return 0;
return hv_ringbuffer_avail_read(rbi, read_loc, write_loc);
}
@ -260,6 +262,8 @@ static inline u32 hv_get_bytes_to_write(const struct hv_ring_buffer_info *rbi)
read_loc = READ_ONCE(rbi->ring_buffer->read_index);
write_loc = READ_ONCE(rbi->ring_buffer->write_index);
if (unlikely(hv_ringbuffer_indices_invalid(rbi, read_loc, write_loc)))
return 0;
return hv_ringbuffer_avail_write(rbi, read_loc, write_loc);
}