[PATCH] KVM: x86/hyperv: Explicitly reject VP Assist Page reads if cache was clobbered

[PATCH] KVM: x86/hyperv: Explicitly reject VP Assist Page reads if cache was clobbered

[Sean Christopherson]

Don't try to read the VP Assist Page if the shared PV EOI cache has been
reconfigured via KVM's actual PV EOI MSR, as trying to read 624 bytes of
info when the cache is setup for only 1 byte will trip the sanity check
WARN in kvm_read_guest_offset_cached().  Ideally, KVM wouldn't use shared
state to track the VP Assist Page, but in practice no sane guest enables
both KVM's PV EOI and Hyper-V's Assist Page at different addresses, i.e.
not allowing both to co-exist independently is "fine".

Fixes: b63cf42fd1d8 ("kvm/x86: implement hv EOI assist")
Cc: stable@vger.kernel.org
Reported-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
Closes: https://lore.kernel.org/all/20261017093016.32348-7-amirmohammad.eftekhar@cispa.de
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/hyperv.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 5d2e3617c952..c08eeaac8bb7 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -949,6 +949,15 @@ int kvm_hv_get_assist_page(struct kvm_vcpu *vcpu)
 	if (!hv_vcpu || !kvm_hv_assist_page_enabled(vcpu))
 		return -EFAULT;
 
+	/*
+	 * KVM reuses its own PV EOI feature to emulate Hyper-V's EOI Assist,
+	 * and rather stupidly reuses the same MSR and cache storage.  Treat
+	 * the assist page as inaccessible if the shared state is configured
+	 * only for PV EOI's single byte of data.
+	 */
+	if (vcpu->arch.pv_eoi.data.len < sizeof(struct hv_vp_assist_page))
+		return -EFAULT;
+
 	return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data,
 				     &hv_vcpu->vp_assist_page, sizeof(struct hv_vp_assist_page));
 }

base-commit: 814607cd40df80d5727957adaa857e0feca43497
-- 
2.56.0.218.g1ec904b173-goog