From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67156328B7B for ; Sat, 25 Jul 2026 15:40:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784994031; cv=none; b=lyeirS6OOfu0Pm3eOB2jH1ZXxPMVj4tUN43ZrIejzNQrqbcvqPpH+4cW6HaXaFAI+3Esk2K9nFmYu0xhUkRGFuhRgYsAYh27G0i31OvJ54x4Q2KafrLeyS+ikE3hpXHJCTP/rDj9LdPI/K79Zuva/9K3ddfDDAwKXA3AlYNU/AU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784994031; c=relaxed/simple; bh=RSNSQ0hf/1ip6FWJhT1UeiihfSgLDoIxgXqaDzmOAho=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=cJCeRdrwwCmsebVN9YgMFUolH6nA38zveZ0rgPfxwoiWCXwPx3MOxx700QuvHCtJWx8hJAKXV/R1EAHFXJeGWvmo4zG4iNN9hHBQNnsjrVX6PeENNtSuYAV4hYQDa+vWBpHF8U6pwYU86NPc/+lzgacBY3HXtdEN+1mF9H3HfOQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=N2oTrqQU; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="N2oTrqQU" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-47ddf7b09e5so1360833f8f.1 for ; Sat, 25 Jul 2026 08:40:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784994029; x=1785598829; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=KkXToa/E/TO7BNSgNTLBSgT6W89C2l7j03X9R0LWBpE=; b=N2oTrqQU+kDOdnDC2I3WCL5cILu5FDE1rj6DSiRERIjCZZXcOySFaldW0i3uk187ln tjHcs0zz4PoW6lWI4vbTfkeJmvaIz1Q2bqUe8LCKbbP9AuElWLel5NgIMjsDHBHPM8mo cr8bKHeVczk0VV3jb3iTiIUbp/mTlsEmdIrXeJGnz/MuNdSk25RpsHtCJ/k5SAbs8Nf4 n4+UtqC0rCHCn3zbIJMhVpFJ1UoUowHByw1ihZKdlL43iFA6pwlxrPtF3xmPKJYJfsLf PvFyiri8bHEmupyDmwr7aoPHUgIKRkWQoD/sgNT/4sJHVB5gZT5InX8W9cruB+K0L32Q i+Sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784994029; x=1785598829; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KkXToa/E/TO7BNSgNTLBSgT6W89C2l7j03X9R0LWBpE=; b=GN3V8+z/HoQJcWNTuGPnnXqLhJRGeS6Fg/lHFBPo1hqd986T892YM3IES4zvOxcezw SBVSZ9m847CxjIij/fG73aPWeUOq5gZK6UT0bkhR9SkGuRdd9m6DNcdzToq1tg2hjNbj qn6e1r9tPOnhTzdxnyKv8GtsICZlmVIAkOXQWjEvluAj0a8air/8Khcomq19sLJA7X7x ZwzCPcfqwMEWspj9gBE27v0a2D8+3D0Kp8MjIUlLNK7yzvPnhMqW8OX6Ux1x2QiHnDvH UOayL4tJRCYcWj77spjSpunMy6mRe2VYPCLavDhylOy7DhIi0NnWA9+g4nXK7bYh/IJg FhDw== X-Forwarded-Encrypted: i=1; AHgh+RqWDMXc+K6XNprCZ09+97Q53DdSmnBTV1OdFXkOyQNyLgzApXGMr+RX96GODtdXjCCTZ3q5NkbVEVFYQZU=@vger.kernel.org X-Gm-Message-State: AOJu0YxN3wZ5/zO0djUjYRZ7ezEbRHdG37iOwpD5LhXtreiLgp8X85dn /BHVgEV5jUZjP8kCcN3pPYaLbMikzLVUcOkc4CAcTeOyJaiBmdt9VXVe X-Gm-Gg: AR+sD10audza5RC9tG4jcrz6FJTiuT/W0nogoAGUMWi/ObNKHnZKJuhlP/V5dJetkL9 pySYmIAm4cZaviIt69pbqY01nZgd2na1BYRIBFOLAShrdeRvytUDBJp4jqCbv91HKN5VS7neZ05 KrOnPv3DAN0hocuK/DTcgqJC3Mr0RkYmCDe1OHb2KizdoiJQ0YiGMGs2Ng45OC8xIoog2Hp7pwX 2ct66wP7vRzWgfi/6OF96RAq1/PjLzFwcqsmuUBzhVyfQsLQqbUzBf3fF3o2Yd6WdknrFhMHTOb sMqk+7tZJp28oRg05C7tPGwhunyLB0vgnaCywciwdxyVvyyVzBD7Vgfy1HgQcapUZ28Br2OLft4 vfUfg8irg1rwAJRxVfgFs9XheseC2KN1OEpI9e1BtiyP58q0A4HmbPdZMRGJobte70RrEHUaMxT B/nL7eTTf4vGhW0o/MtdwTFN9K/3iAbFKNn+Uo/fSswD+3KC4yaApeTC0jNZq8MjyDTvrztbacL BsjDvEahjIstSpeAyeqA079uSglwbfkfc3tBtpXu0pXyCYf0MuaX9Wo9dEpNnN78M+UIZGuVF2Q /JDsgg+RfMP39wet5yTp X-Received: by 2002:a05:6000:1ac6:b0:47f:9557:8d77 with SMTP id ffacd0b85a97d-47f9fc82ceamr3194678f8f.10.1784994028285; Sat, 25 Jul 2026 08:40:28 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-b344-be01-c902-8e3f-9491-60c2.310.pool.telefonica.de. [2a02:3100:b344:be01:c902:8e3f:9491:60c2]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85a2573csm32832468f8f.0.2026.07.25.08.40.26 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 25 Jul 2026 08:40:27 -0700 (PDT) From: Karl Mehltretter To: Marc Zyngier , Oliver Upton Cc: Karl Mehltretter , Fuad Tabba , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate() Date: Sat, 25 Jul 2026 17:40:20 +0200 Message-Id: <20260725154020.37305-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vgic_v2_deactivate() passes the INTID from a trapped GICV_DIR write to vgic_get_vcpu_irq() without checking it against the number of implemented interrupts. An out-of-range INTID makes the lookup return NULL and triggers WARN_ON_ONCE(!irq). A guest using EOImode=1 can therefore raise a host warning, or panic a host with panic_on_warn=1. The GICv3 counterpart rejects INTIDs outside the configured SGI, PPI and SPI range before performing the lookup. Add the same check to the GICv2 path. Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter --- arch/arm64/kvm/vgic/vgic-v2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c index cafa3cb32bda..42430c0fee07 100644 --- a/arch/arm64/kvm/vgic/vgic-v2.c +++ b/arch/arm64/kvm/vgic/vgic-v2.c @@ -163,8 +163,12 @@ void vgic_v2_deactivate(struct kvm_vcpu *vcpu, u32 val) cpuid = FIELD_GET(GENMASK_ULL(12, 10), val); val &= ~GENMASK_ULL(12, 10); - /* We only deal with DIR when EOIMode==1 */ - if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK)) + /* + * We only deal with DIR when EOIMode==1, and only for SGI, + * PPI or SPI. + */ + if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK) || + val >= vcpu->kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS) return; /* Make sure we're in the same context as LR handling */ -- 2.39.5 (Apple Git-154)