Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 10 Oct 2022 17:15:40 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Oliver Upton <oupton@google.com>
Cc:     lkp@intel.com, kbuild-all@lists.01.org,
        linux-kernel@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>
Subject: [kbuild] arch/x86/kvm/x86.c:4988 kvm_arch_tsc_set_attr() warn: check
 for integer overflow 'offset'
Message-ID: <202210102159.8nYEC0Hl-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?XFFTWqDEqhg6FF5bnQnI2rJYFZMQGUp0GY0a+dhJJcfHxQY24PZct5CqNN1Z?=
 =?us-ascii?Q?5O8G9sn3K9lLeJnxUQ8XqEzikPDRj8vqXPWUp6f/PqlqsNzVeneEHsh/HiPW?=
 =?us-ascii?Q?2y1eaOiL1EtKvnEr+P0ZiO3ZGQ5nATgh+KXKP/1+UCzBh4NMdThOAHXc8odS?=
 =?us-ascii?Q?ThgciP8nQdnzIRaaNt2IpighsZxZ4kaaICgtI4iCkCWdzSyxxQGyeov3SKQw?=
 =?us-ascii?Q?i5Uf7+zmqVqKKw1Wn2oWpAwGzvcUebvQ1w3bqE3Ietcshnj8QeWL//rLS7bI?=
 =?us-ascii?Q?gXdmOKJYjVoNhZ9iat+GshgDpkgKplDgAEqaksQBisl5Da4eqgNC5Kj/0QG5?=
 =?us-ascii?Q?M/xnSZbqJitjx11F14OYvParqEfRW8a5GldaW1tK4M3iP6whLYUrAvucxT+Q?=
 =?us-ascii?Q?sT0jFuGycqdIoHnaRZgvqexs545v8dJrygwDb3xjoaCuWUdzHspzaLlgTPPY?=
 =?us-ascii?Q?Ip2+wEq4BTuiHJhESrPtdOR5zXC3mPWqBA353niGmNC8OBzFK5dGqTF3IHKP?=
 =?us-ascii?Q?sQOveowB4zLm3gXtNMWovd6k1Y26e+3b0xIsDIx7Ee88r6v9z1Mz0pouwnv5?=
 =?us-ascii?Q?e3GvFBDjv7xEHkyoIX/PdPyXNn2uquOd2hFKVGSsRNT10MEFcHc+pqjACDec?=
 =?us-ascii?Q?aGNVbbw7E59Hmp+cnrNCifF1GJjAgmciizO4JTDONXl/mQiPIdfmbf7NQJGD?=
 =?us-ascii?Q?a4RQ2eILOTlKMXDR753IZLEZIBKezAM6J3HV+uorE+RUwmhiPqzm/lRRQoQa?=
 =?us-ascii?Q?0UNbS5LzesDsWGsFjVGjiUX4ZWjclb4sk/Zot7mRUPcF7mg3a3BQA8AcQ6Dx?=
 =?us-ascii?Q?QFHmARvJbY+3Ls+lIRbQtMmiCPCZLWB3XpfToAfZidvwxE7mLXBgXEa7Tct0?=
 =?us-ascii?Q?kq47WOIhBYqnpCHICglwr+/GMoSRwcJyFtCM9mnD4Mkgbszp7PiaA8mPPQsv?=
 =?us-ascii?Q?ryWsibfzfD/7edjo9BZSSFNlOpEPe+V7sx7MmFtJcMTk6VfXeuu1X8yQmSNw?=
 =?us-ascii?Q?r2BSXPKbLvzBwRNFsKPTAsv4ZKpYdWDOWAmR6JSDAKFNYYowfwJTWU7HY+3T?=
 =?us-ascii?Q?iFWiqyBYQjwm2r4S4QT8cFtSC3S3K74prLChxv+e2nNqPHoXfPeyxEpvmMVH?=
 =?us-ascii?Q?0XWYgDrdldk67sM6Rlr47pTV1kLN9Is43Khg0h8YkXzcX4NcZRmeAo1rc58P?=
 =?us-ascii?Q?zpcHtB5PZEuUTuVF+fIXIZRY2quNS5CFRMFKqF4NKFYrKqKIeUCo5gjNuMCP?=
 =?us-ascii?Q?Nd+QN0sWPjkaJYNPs9F5XMA7cujQUL2QU0vFoP++Cr2ruYXGcj2PyISMkJ4n?=
 =?us-ascii?Q?ZXzZEdB1H2s9OWvKZID7i9Z59gkW96Ws8207uGGnI80tqWMYSfIUXa+qwt71?=
 =?us-ascii?Q?bVy6udysqzN6+PPsKBvHxqv7rdHeWWimhc70e5y81Fn/ja6SrCruUFgFr5eZ?=
 =?us-ascii?Q?v5D4lAEn9DvE5s3RHbJroiEMNt6rLiwnM/Z1dJPzzztpG0DxFMQOT82gbWq1?=
 =?us-ascii?Q?ZtxCUJvFG32TdJ3oDw4bsglCNM8w3dAwRw0NbpJL5oj+Y7syYKutmYW1lFRu?=
 =?us-ascii?Q?jhUqQFeI5FD+q5i/A4J3rqErXY3CvtJHKqYDWDIeCuY0bHtgIynz6nHp7aI6?=
 =?us-ascii?Q?zQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 78d1e26f-617d-470c-a389-08daaac9f321
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Oct 2022 14:15:57.2125
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: RJht3GgNwIonNxZk5ECLIFigYhIWuwoh+BzVS2Z/nRkyP7tR0Z7DCUdz2P5zRVKXreIWtTpYZX7IKqYdjOJzgOGe3GCh4ua4yMllFe13LmQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0PR10MB5368
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-10-10_08,2022-10-10_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 suspectscore=0
 phishscore=0 mlxscore=0 malwarescore=0 spamscore=0 mlxlogscore=999
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2209130000 definitions=main-2210100085
X-Proofpoint-GUID: U_74ggNmrJAujclveGO0FJU06TL8MeAk
X-Proofpoint-ORIG-GUID: U_74ggNmrJAujclveGO0FJU06TL8MeAk
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git   master
head:   493ffd6605b2d3d4dc7008ab927dba319f36671f
commit: 828ca89628bfcb1b8f27535025f69dd00eb55207 KVM: x86: Expose TSC offset controls to userspace
config: x86_64-randconfig-m001-20221010
compiler: gcc-11 (Debian 11.3.0-5) 11.3.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
arch/x86/kvm/x86.c:4988 kvm_arch_tsc_set_attr() warn: check for integer overflow 'offset'

vim +/offset +4988 arch/x86/kvm/x86.c

828ca89628bfcb Oliver Upton 2021-09-16  4962  static int kvm_arch_tsc_set_attr(struct kvm_vcpu *vcpu,
828ca89628bfcb Oliver Upton 2021-09-16  4963  				 struct kvm_device_attr *attr)
828ca89628bfcb Oliver Upton 2021-09-16  4964  {
828ca89628bfcb Oliver Upton 2021-09-16  4965  	u64 __user *uaddr = (u64 __user *)(unsigned long)attr->addr;
828ca89628bfcb Oliver Upton 2021-09-16  4966  	struct kvm *kvm = vcpu->kvm;
828ca89628bfcb Oliver Upton 2021-09-16  4967  	int r;
828ca89628bfcb Oliver Upton 2021-09-16  4968  
828ca89628bfcb Oliver Upton 2021-09-16  4969  	if ((u64)(unsigned long)uaddr != attr->addr)
828ca89628bfcb Oliver Upton 2021-09-16  4970  		return -EFAULT;
828ca89628bfcb Oliver Upton 2021-09-16  4971  
828ca89628bfcb Oliver Upton 2021-09-16  4972  	switch (attr->attr) {
828ca89628bfcb Oliver Upton 2021-09-16  4973  	case KVM_VCPU_TSC_OFFSET: {
828ca89628bfcb Oliver Upton 2021-09-16  4974  		u64 offset, tsc, ns;
828ca89628bfcb Oliver Upton 2021-09-16  4975  		unsigned long flags;
828ca89628bfcb Oliver Upton 2021-09-16  4976  		bool matched;
828ca89628bfcb Oliver Upton 2021-09-16  4977  
828ca89628bfcb Oliver Upton 2021-09-16  4978  		r = -EFAULT;
828ca89628bfcb Oliver Upton 2021-09-16  4979  		if (get_user(offset, uaddr))
828ca89628bfcb Oliver Upton 2021-09-16  4980  			break;
828ca89628bfcb Oliver Upton 2021-09-16  4981  
828ca89628bfcb Oliver Upton 2021-09-16  4982  		raw_spin_lock_irqsave(&kvm->arch.tsc_write_lock, flags);
828ca89628bfcb Oliver Upton 2021-09-16  4983  
828ca89628bfcb Oliver Upton 2021-09-16  4984  		matched = (vcpu->arch.virtual_tsc_khz &&
828ca89628bfcb Oliver Upton 2021-09-16  4985  			   kvm->arch.last_tsc_khz == vcpu->arch.virtual_tsc_khz &&
828ca89628bfcb Oliver Upton 2021-09-16  4986  			   kvm->arch.last_tsc_offset == offset);
828ca89628bfcb Oliver Upton 2021-09-16  4987  
828ca89628bfcb Oliver Upton 2021-09-16 @4988  		tsc = kvm_scale_tsc(vcpu, rdtsc(), vcpu->arch.l1_tsc_scaling_ratio) + offset;

Smatch hates obvious user triggerable integer overflows...  No checking
on offset.

828ca89628bfcb Oliver Upton 2021-09-16  4989  		ns = get_kvmclock_base_ns();
828ca89628bfcb Oliver Upton 2021-09-16  4990  
828ca89628bfcb Oliver Upton 2021-09-16  4991  		__kvm_synchronize_tsc(vcpu, offset, tsc, ns, matched);
828ca89628bfcb Oliver Upton 2021-09-16  4992  		raw_spin_unlock_irqrestore(&kvm->arch.tsc_write_lock, flags);
828ca89628bfcb Oliver Upton 2021-09-16  4993  
828ca89628bfcb Oliver Upton 2021-09-16  4994  		r = 0;
828ca89628bfcb Oliver Upton 2021-09-16  4995  		break;
828ca89628bfcb Oliver Upton 2021-09-16  4996  	}
828ca89628bfcb Oliver Upton 2021-09-16  4997  	default:
828ca89628bfcb Oliver Upton 2021-09-16  4998  		r = -ENXIO;
828ca89628bfcb Oliver Upton 2021-09-16  4999  	}
828ca89628bfcb Oliver Upton 2021-09-16  5000  
828ca89628bfcb Oliver Upton 2021-09-16  5001  	return r;
828ca89628bfcb Oliver Upton 2021-09-16  5002  }