On Mon, Oct 19, 2026 at 04:09:45PM -0700, Kameron Carr wrote: > In a CoCo VM the host is untrusted. Since the VMBus ring buffer read and > write indices live in shared memory, the guest has to treat both as > potentially malicious and as changing at any time. This patch series > adds bounds checking and reuses the validated indices instead of > re-accessing them. > > Patch 1 contains the minimum security fix, and is the only patch in the > series intended to be backported. hv_ringbuffer_write() copies into the > ring at the write index, so a malicious host can make the guest write to > memory outside the ring buffer. This is reachable on any channel a CoCo > VM accepts. > > Patches 2 and 3 add READ/WRITE_ONCE annotations and refactor the helper > functions to allow the caller to work with a consistent snapshot of the > ring buffer indices. > > Patch 4 adds the rest of the bounds checking. The memcopy() in > hv_pkt_iter_avail() can only result in an out-of-bounds read if > rbi->pkt_buffer_size exceeds the ring's data size. KVP is the only > in-tree channel whose max_pkt_size exceeds its ring's data size (16K vs > 12K on a 4K page guest). CoCo VMs reject the KVP channel, so this bug is > currently unreachable on CoCo VMs. The other paths patch 4 checks can't > cause a bad access, only a nonsense byte count or a wrong signaling > decision.
Thanks for the fix! For the series, Reviewed-by: Mitchell Levy (Microsoft) <[email protected]>
