Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Reply-To: Sean Christopherson <seanjc@google.com>
Date:   Thu,  7 Oct 2021 16:16:47 -0700
Message-Id: <20211007231647.3553604-1-seanjc@google.com>
Mime-Version: 1.0
Subject: [PATCH] KVM: x86: Account for 32-bit kernels when handling address in
 TSC attrs
From:   Sean Christopherson <seanjc@google.com>
To:     Paolo Bonzini <pbonzini@redhat.com>
Cc:     Sean Christopherson <seanjc@google.com>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, Oliver Upton <oupton@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

When handling TSC attributes, cast the userspace provided virtual address
to an unsigned long before casting it to a pointer to fix warnings on
32-bit kernels due to casting a 64-bit integer to a 32-bit pointer.

Add a check that the truncated address matches the original address, e.g.
to prevent userspace specifying garbage in bits 63:32.

  arch/x86/kvm/x86.c: In function =E2=80=98kvm_arch_tsc_get_attr=E2=80=99:
  arch/x86/kvm/x86.c:4947:22: error: cast to pointer from integer of differ=
ent size
   4947 |  u64 __user *uaddr =3D (u64 __user *)attr->addr;
        |                      ^
  arch/x86/kvm/x86.c: In function =E2=80=98kvm_arch_tsc_set_attr=E2=80=99:
  arch/x86/kvm/x86.c:4967:22: error: cast to pointer from integer of differ=
ent size
   4967 |  u64 __user *uaddr =3D (u64 __user *)attr->addr;
        |                      ^

Cc: Oliver Upton <oupton@google.com>
Fixes: 469fde25e680 ("KVM: x86: Expose TSC offset controls to userspace")
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/x86.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 196ac33ef958..4a52a08707de 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4944,9 +4944,12 @@ static int kvm_arch_tsc_has_attr(struct kvm_vcpu *vc=
pu,
 static int kvm_arch_tsc_get_attr(struct kvm_vcpu *vcpu,
 				 struct kvm_device_attr *attr)
 {
-	u64 __user *uaddr =3D (u64 __user *)attr->addr;
+	u64 __user *uaddr =3D (u64 __user *)(unsigned long)attr->addr;
 	int r;
=20
+	if ((u64)(unsigned long)uaddr !=3D attr->addr)
+		return -EFAULT;
+
 	switch (attr->attr) {
 	case KVM_VCPU_TSC_OFFSET:
 		r =3D -EFAULT;
@@ -4964,10 +4967,13 @@ static int kvm_arch_tsc_get_attr(struct kvm_vcpu *v=
cpu,
 static int kvm_arch_tsc_set_attr(struct kvm_vcpu *vcpu,
 				 struct kvm_device_attr *attr)
 {
-	u64 __user *uaddr =3D (u64 __user *)attr->addr;
+	u64 __user *uaddr =3D (u64 __user *)(unsigned long)attr->addr;
 	struct kvm *kvm =3D vcpu->kvm;
 	int r;
=20
+	if ((u64)(unsigned long)uaddr !=3D attr->addr)
+		return -EFAULT;
+
 	switch (attr->attr) {
 	case KVM_VCPU_TSC_OFFSET: {
 		u64 offset, tsc, ns;
--=20
2.33.0.882.g93a45727a2-goog