[SRU][J][PATCH] KVM: SEV: Ignore Port I/O requests of length '0'

[Rickey Castillo]

From: Sean Christopherson <seanjc at google.com>

commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream.

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that
setting up the software scratch area (and other code) doesn't have to
worry about underflowing the length, and to allow for WARNing on trying
to configure the scratch area with len==0.

Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT")
Cc: stable at vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky at amd.com>
Signed-off-by: Sean Christopherson <seanjc at google.com>
Message-ID: <20260501202250.2115252-5-seanjc at google.com>
Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
Signed-off-by: Jack Wang <jinpu.wang at ionos.com>
Signed-off-by: Sasha Levin <sashal at kernel.org>
(cherry picked from commit 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 linux-6.12.y)
CVE-2026-63940
Signed-off-by: Rickey Castillo <rickey.castillo.valenzuela at canonical.com>
---
 arch/x86/kvm/svm/sev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 5951435be3ff..4f4e9b09e26e 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -2632,6 +2632,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 			    control->exit_info_1, control->exit_info_2);
 		ret = -EINVAL;
 		break;
+	case SVM_EXIT_IOIO:
+		if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT))
+			return 1;
+
+		fallthrough;
 	default:
 		ret = svm_invoke_exit_handler(vcpu, exit_code);
 	}
@@ -2652,6 +2657,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
 	if (unlikely(check_mul_overflow(count, size, &bytes)))
 		return -EINVAL;
 
+	if (!bytes)
+		return 1;
+
 	r = setup_vmgexit_scratch(svm, in, bytes);
 	if (r)
 		return r;
-- 
2.53.0