From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f44.google.com (mail-ej1-f44.google.com [209.85.218.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBFCC37BE96 for ; Mon, 8 Jun 2026 12:35:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780922127; cv=none; b=QSTU5oiv+ep71aT97DvOrHhbF82aIuEwJrabQ8BKiJn7yAWpR/OkXoNnlFfsO4MEbDUf+8CzeuYY8tTwZ+r/5c0iR7cRHJpEO2xILSZYpFZjm3/QtM/wEfOrm9I8A5yI718/6076UjRgNFNAFHfKc1pK9p0k00D00oWv8PJN5eQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780922127; c=relaxed/simple; bh=CYYDWqyVN6rQRyrhyeSFNbNRecXMfXc9yaACOsDkXqE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=onz55sZmKGI34EXI5twqTAQj6AhxJp5syzXI32xEeHoi86PSTDq44M8oeD7EyuV6QkLVanOXzXgp4gpJM7yr6Y/C9WdWLs0/6dEIhCQRJAxyhDqs3CWKCWAAza8OO61H4WP6HNio5eh4hvo5EJy9uEtSwB4CAnwJQcwJw3VYHUQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BTLQIxpO; arc=none smtp.client-ip=209.85.218.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BTLQIxpO" Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-bebde8a0adfso60918666b.1 for ; Mon, 08 Jun 2026 05:35:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780922124; x=1781526924; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=z+NDiLOfcXQ8JmuQqrk6+Ji+NDT4+3lQ7MCKUmz9FTk=; b=BTLQIxpOdMFfv+Pdqw+8LaWLszo4ixaRviwDSiFdY/StYWJD+FZI5QeMvjJkRIeoX+ qpp+uWHRJ3eihuvJnkp4o29fMRhWfCKVeuruZ/bkvfmw8TtiZvnLoiD1FMPetgBeoMYn aMKvSclolACR47NR+uX+F7UYFopf3Fiw1nb7mh7kwZ4VHw0J2HfrmwbpCHRWJwr+LMLQ Ygfy12luNRy75hV+4qwH1PjKiFxDYzVs9hQOIRlbE62GGkeDiG4NcmFDyLNGo0W/SnBQ q6yYPdfqjFGwDdsZ+wyNwoFz2IsmIJllCUKLZu7iQIcX6OQ68AA4JdvdcnuG/Z9NgoLE XFsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780922124; x=1781526924; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=z+NDiLOfcXQ8JmuQqrk6+Ji+NDT4+3lQ7MCKUmz9FTk=; b=bQtkqOvIw76hCLRg6EexB4hElp6USeQnSx2ECWdlnWp3q6YgX4JnPIrO/xuZto9iC+ QDqm6+jCaH+gNYy5++5/JUcYw7tjUm+CQ/ZdWnQ0trv4OUcgaKovkOEER94hTPKji+j/ fXxFSwbr44XY51ZRuHHCpLxWrAYtj2dy7U2Tz72hNwN7sCv5km+OWPpG0Y3jdv7BbewB SOyOD99VAsE6XmMyor7x7BYm0qYa7kQsP2XeTi7UnYv8LJlp4Xy48a9hG9PC4X4ZXSeb SBkpKivHYKkjy68qlFApok6Y5XIPgIfJjzQ03qLZYCnLAB8c1uCfe050Tn9bdecMrJy6 QmMw== X-Forwarded-Encrypted: i=1; AFNElJ8UIEXaRKrzzxA1RqoBWIC5qMZ4QnKohpco9W7FtFfMeH2K1a8EShCNCgruacM05iK3vE/Ad0NPAPe/pys=@vger.kernel.org X-Gm-Message-State: AOJu0YxMxhFOQM9IwIwDP+rfwmo1FuZmV3MS93NV8ATgM6segRsK5H5r z5Q6rWXhGS+t8+EzE+L5BZKVOuS7Ivufn6tZ1tgt5u5r7oyz9wXWgO+Q X-Gm-Gg: Acq92OGLc+VFiqR4Yy8mV7Rs2NN0HnpM8iBx5hCZs1bCNC5MqiOhybmZSsqvhNuq09j rlgyn7uwfCJBHmMmh8u3vEBgXYk74usMikIBbgFbw4orpActmOiZFMGyS4lRMJgTABne8EOCTxo wElhgu+Edz5MQkFp4w5ifxtT6v123Ik08WNoVhx98B2HshTGncCKv3jXzvsvvMJqvmGuwxvTGOt vOsz7v/Wnyu2wwVZ/+pkhzTZcK3CI9tsdjCFAUOnUAkoK/Marwr6AqUs1ZkDO6HHCumZmVVubiu wRe97nLqZu1YFF2ExI9XVd2ePcr/AYDjA5gW8hiV7vh9F8JjEv465CGxYKSiRf4uxTjm+jDiJCW dGNKxNad2Zq40d5ZXH7ldoTf1BPKxWUgyBBSKVuK2wq3rgy+BaNMOHDhvbbzZPwsqsoik7p+1gE zWlVkKmrBj8DC5Bc8ZognqOSnH/T2g7ntlKURm3LNIaI+QJ1knfix9Nh2mG9pa6B6r13IR X-Received: by 2002:a17:907:971b:b0:beb:cc42:eaa8 with SMTP id a640c23a62f3a-bf37076c08bmr353336766b.1.1780922123939; Mon, 08 Jun 2026 05:35:23 -0700 (PDT) Received: from Kayra-MacBook-Pro ([2a00:1d34:85f:fd00:89b:7f3a:f691:1b4b]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-bf3e39647c4sm485107366b.63.2026.06.08.05.35.21 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 08 Jun 2026 05:35:23 -0700 (PDT) From: Kayra Cizmeci To: seanjc@google.com, pbonzini@redhat.com Cc: tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kbuild@vger.kernel.org, Kayra Cizmeci Subject: [PATCH] KVM: x86: Add IDT limit check in __emulate_int_real() Date: Mon, 8 Jun 2026 15:35:02 +0300 Message-ID: <20260608123503.23298-1-kayracizmeci@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit During real mode interrupt emulation, KVM currently pushes data to the stack before checking IDT limits. This patch fetches the IDT early and injects a #GP if the limit is exceeded. This prevents potential corruption. Signed-off-by: Kayra Cizmeci --- arch/x86/kvm/emulate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 8013dccb3110..04e6c80bdb14 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -2022,7 +2022,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) gva_t eip_addr; u16 cs, eip; - /* TODO: Add limit checks */ + ops->get_idt(ctxt, &dt); + + if (dt.size < (irq << 2) + 3) + return emulate_gp(ctxt, 0); + ctxt->src.val = ctxt->eflags; rc = em_push(ctxt); if (rc != X86EMUL_CONTINUE) @@ -2040,8 +2044,6 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) if (rc != X86EMUL_CONTINUE) return rc; - ops->get_idt(ctxt, &dt); - eip_addr = dt.address + (irq << 2); cs_addr = dt.address + (irq << 2) + 2; -- 2.54.0