From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02ECC3B42DE for ; Sun, 2 Aug 2026 13:44:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785678302; cv=none; b=AtzCuwCQwxlthN5sphfYMA8qwEHzPJmw+Skc9Olggz087pVuM5kYVDgMwSlbGaWt/3lfbZ8GpDI4SbydlumFaFNtt3voTCE6Qu3G4oO0i5TUoPIDJYxDGlCkDhlyvJb+iCX/Vkd62C3FP76BiP5LrYziiOSeaZUTJNtWRQ/DbBs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785678302; c=relaxed/simple; bh=gZ0UUdT48hbMs0jRzaOu4QypASHEVAG3ns1aMnD1mIs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FCJfFbBSaw6W+25LSd/NN2XRJ4eJ8frQGrA9dHH3ZhMoYzr0j4gGPTu7JlpkIrLNE004xrjcSYWNFm2dT4Ps/vAIQHcJQuJdsQLPyF07iNOGKuX/9L1HBWQl0yfmyM74LErWN0KJ4G+MFQKZZk/dd3oGF0xk6gKaPzsxZmqFLQY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=H1iYj0ES; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="H1iYj0ES" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-494049206c6so1954835e9.2 for ; Sun, 02 Aug 2026 06:44:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785678297; x=1786283097; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=uvXixwprFJLlnKdN8GIk4RHMYlK0y98sLKZBpOoa3aw=; b=H1iYj0ESnbzVi2khpFQfnxuDo/hj6yy0IDkUhmAagxrC/t0buB/BuP4lhUnm4Ps1El tiXjkJJL+w2eYxgw7nfF8ME+yjxXtJBYSNnGeigPqoMMlQSZsyNlEugSHGPigsEIbzdm 1LBwqy+WSJ1oMK4B7pXPlTGDOUmU5s5ny0FQApck29QmrccRYGVoyXfpZhQcY3TRXhGW 41cysmD+qK+IDgaMAW3Y6obRsjWHgm9vlG3t56aCXtPlN+IAIS45xbo3N2aQxCo3lBhF WII4HClZgM2ZN1HMCA6mMiM71icNjIHY8Na0XgJzlHfXSrv0/pfq8ZFQMheqMdBK00K7 YKSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785678297; x=1786283097; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=uvXixwprFJLlnKdN8GIk4RHMYlK0y98sLKZBpOoa3aw=; b=Y6IGl1FclA8MzTAnUr3/0e9vG9dtE2lA6486ZAoLMPix5OGFFwHH3qfMDIx20oZigG Z7XH0dwFZlmllig+AeeF0Px7rHK2+j15aufN932JgMGv+GWXK7qFUT4VyKSnDVZfxCeF FUzuLRyG/42KjiYbvohNIHZKv1vOyI3OtOr/8CYzhGWooJ7ar9zZbBeM8HY3/85YLspB ANQ00hdpOyBNFFLC+yIq+frfgko0LFelPj/qd3Mb2ba33XH5vLgLUoVhXIib0aAwakzz Pm0Q8SKekXElbuSOPAehVCoelafOxJlJZQu6h/Nd4WPUFL9JQ6xEZ6tNWHVakZ6qgI+g g91g== X-Forwarded-Encrypted: i=1; AHgh+RqRB38UNw2SSJ4dEWDkUITQlkfo3FHPDdTMpBKco0jRFMqLsw0aQdbcXUkQSLotvSx8SUXNil0T08FCpUg=@vger.kernel.org X-Gm-Message-State: AOJu0YytEoh4DFGxeaOCktJxuyKSNvArWXovb+l6A5rmoYOGhFQWTYo2 1qhTrZLDM12BZ92JRL90a/hWzRZWHEEy1nKCMcGG9DX/Iz5SP/gd0LuW X-Gm-Gg: AR+sD12vYWmGOXvHsmZePb2WTmaKZaLcIcB57AdX+hMfX8pKH9rr4zBpNoTrx/clg4m 6WGyagr9efe0NT9iW0V/NAwmrSyVXVEM801jobBb7F5WiXHid23eCKUUhWwm1EiaT/LErwTGlYG U4ENw6qe0fwma7CTefy35DGqdxz1CJvg+gE0rfseSR0LHa6GSTHKIeywcmSIpb5JKxn4IWVtvNl dKv1cIGj7Aqt0Gb8ZJqrGe9NmmWQpfG6hr+0rWnemwn+C3OxXfpqRnDLmwF5PB2ECgbkVrw3GPg O2bsQAR1YV0GvNjbrAT8nSgd7uUUclEjn8xJ4bv7gY25v487Amyt3hVr5uqNcm+6uu6zZKCIn3E ybp+KwtivH4Q1pVwENI7jqugl7SiDh7sZZLdVSqsP97x798o/kci7WChrVEZFkcjKGmpw7hbann rvpEiA/HHRjcuawxYtXczFtGv3zkkWHfwlEC43EVRWAHRdv33+rpy8AeHOg7YA3ThO9ISHaYNaf QDcO5p7pDs= X-Received: by 2002:a05:600c:5487:b0:495:4505:dad0 with SMTP id 5b1f17b1804b1-4980c68e1b4mr68517975e9.2.1785678296748; Sun, 02 Aug 2026 06:44:56 -0700 (PDT) Received: from lima-kdev.local ([85.99.180.157]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49807ba8032sm112278855e9.15.2026.08.02.06.44.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Aug 2026 06:44:55 -0700 (PDT) From: Kayra Cizmeci To: seanjc@google.com, pbonzini@redhat.com Cc: tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Kayra Cizmeci Subject: [PATCH v3 2/2] KVM: x86: Add limit check to IDT in __emulate_int_real() Date: Sun, 2 Aug 2026 16:44:28 +0300 Message-ID: <20260802134428.69252-2-kayracizmeci@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260802134428.69252-1-kayracizmeci@gmail.com> References: <20260802134428.69252-1-kayracizmeci@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Currently there are no limit check at __emulate_int_real(), and normally greater numbers than the IDT limits needs to cause a #GP, but currently there is no limit check for doing that. So add a limit check for IDT to catch greater numbers than the IDT limit and if the number is greater than the IDT limit inject a #GP. Signed-off-by: Kayra Cizmeci --- v1: adds IDT limit check to __emulate_int_real(), link: https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@gmail.com/ v2: fixes the sign-extension of INT n, link: https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@gmail.com/ v3: rewrote commit messages, split 1 commit into 2 commits and rebased onto current mainline. arch/x86/kvm/emulate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index ec3138801bb7..68d099131d47 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -2023,7 +2023,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) gva_t eip_addr; u16 cs, eip; - /* TODO: Add limit checks */ + ops->get_idt(ctxt, &dt); + + if (dt.size < (irq << 2) + 3) + return emulate_gp(ctxt, 0); + ctxt->src.val = ctxt->eflags; rc = em_push(ctxt); if (rc != X86EMUL_CONTINUE) @@ -2041,8 +2045,6 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) if (rc != X86EMUL_CONTINUE) return rc; - ops->get_idt(ctxt, &dt); - eip_addr = dt.address + (irq << 2); cs_addr = dt.address + (irq << 2) + 2; -- 2.53.0