[PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate()

[Karl Mehltretter <kmehltretter@gmail.com>]

vgic_v2_deactivate() passes the INTID from a trapped GICV_DIR write to
vgic_get_vcpu_irq() without checking it against the number of
implemented interrupts. An out-of-range INTID makes the lookup return
NULL and triggers WARN_ON_ONCE(!irq).

A guest using EOImode=1 can therefore raise a host warning, or panic a
host with panic_on_warn=1.

The GICv3 counterpart rejects INTIDs outside the configured SGI, PPI and
SPI range before performing the lookup. Add the same check to the GICv2
path.

Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 arch/arm64/kvm/vgic/vgic-v2.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c
index cafa3cb32bda..42430c0fee07 100644
--- a/arch/arm64/kvm/vgic/vgic-v2.c
+++ b/arch/arm64/kvm/vgic/vgic-v2.c
@@ -163,8 +163,12 @@ void vgic_v2_deactivate(struct kvm_vcpu *vcpu, u32 val)
 	cpuid = FIELD_GET(GENMASK_ULL(12, 10), val);
 	val &= ~GENMASK_ULL(12, 10);
 
-	/* We only deal with DIR when EOIMode==1 */
-	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK))
+	/*
+	 * We only deal with DIR when EOIMode==1, and only for SGI,
+	 * PPI or SPI.
+	 */
+	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK) ||
+	    val >= vcpu->kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)
 		return;
 
 	/* Make sure we're in the same context as LR handling */
-- 
2.39.5 (Apple Git-154)