All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-02-27 13:46 ` Radim Krčmář
  0 siblings, 0 replies; 9+ messages in thread
From: Radim Krčmář @ 2026-02-27 13:46 UTC (permalink / raw)
  To: kvm-riscv
  Cc: Lukas Gerlach, Anup Patel, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest, but it
could only access another guest accessible data.

Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
---
 arch/riscv/kvm/vcpu_pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index 4d8d5e9aa53d..aec6b293968b 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
 {
 	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
 
-	if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
+	if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
 		retdata->err_val = SBI_ERR_INVALID_PARAM;
 		return 0;
 	}
-- 
2.51.2


-- 
kvm-riscv mailing list
kvm-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kvm-riscv

^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-02-27 13:46 ` Radim Krčmář
  0 siblings, 0 replies; 9+ messages in thread
From: Radim Krčmář @ 2026-02-27 13:46 UTC (permalink / raw)
  To: kvm-riscv
  Cc: Lukas Gerlach, Anup Patel, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest, but it
could only access another guest accessible data.

Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
---
 arch/riscv/kvm/vcpu_pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index 4d8d5e9aa53d..aec6b293968b 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
 {
 	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
 
-	if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
+	if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
 		retdata->err_val = SBI_ERR_INVALID_PARAM;
 		return 0;
 	}
-- 
2.51.2


^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-02-27 13:46 ` Radim Krčmář
  0 siblings, 0 replies; 9+ messages in thread
From: Radim Krčmář @ 2026-02-27 13:46 UTC (permalink / raw)
  To: kvm-riscv
  Cc: Lukas Gerlach, Anup Patel, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest, but it
could only access another guest accessible data.

Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
---
 arch/riscv/kvm/vcpu_pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index 4d8d5e9aa53d..aec6b293968b 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
 {
 	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
 
-	if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
+	if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
 		retdata->err_val = SBI_ERR_INVALID_PARAM;
 		return 0;
 	}
-- 
2.51.2


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply related	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
  2026-02-27 13:46 ` Radim Krčmář
  (?)
@ 2026-03-02 13:10   ` Anup Patel
  -1 siblings, 0 replies; 9+ messages in thread
From: Anup Patel @ 2026-03-02 13:10 UTC (permalink / raw)
  To: Radim Krčmář
  Cc: kvm-riscv, Lukas Gerlach, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

On Fri, Feb 27, 2026 at 7:20 PM Radim Krčmář
<radim.krcmar@oss.qualcomm.com> wrote:
>
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
>
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>

Thanks for catching.

Reviewed-by: Anup Patel <anup@brainfault.org>

Queued this patch as fixes for Linux-7.0-rcX.

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_pmu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
> index 4d8d5e9aa53d..aec6b293968b 100644
> --- a/arch/riscv/kvm/vcpu_pmu.c
> +++ b/arch/riscv/kvm/vcpu_pmu.c
> @@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
>  {
>         struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
>
> -       if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
> +       if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
>                 retdata->err_val = SBI_ERR_INVALID_PARAM;
>                 return 0;
>         }
> --
> 2.51.2
>

-- 
kvm-riscv mailing list
kvm-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kvm-riscv

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-03-02 13:10   ` Anup Patel
  0 siblings, 0 replies; 9+ messages in thread
From: Anup Patel @ 2026-03-02 13:10 UTC (permalink / raw)
  To: Radim Krčmář
  Cc: kvm-riscv, Lukas Gerlach, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

On Fri, Feb 27, 2026 at 7:20 PM Radim Krčmář
<radim.krcmar@oss.qualcomm.com> wrote:
>
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
>
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>

Thanks for catching.

Reviewed-by: Anup Patel <anup@brainfault.org>

Queued this patch as fixes for Linux-7.0-rcX.

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_pmu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
> index 4d8d5e9aa53d..aec6b293968b 100644
> --- a/arch/riscv/kvm/vcpu_pmu.c
> +++ b/arch/riscv/kvm/vcpu_pmu.c
> @@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
>  {
>         struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
>
> -       if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
> +       if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
>                 retdata->err_val = SBI_ERR_INVALID_PARAM;
>                 return 0;
>         }
> --
> 2.51.2
>

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-03-02 13:10   ` Anup Patel
  0 siblings, 0 replies; 9+ messages in thread
From: Anup Patel @ 2026-03-02 13:10 UTC (permalink / raw)
  To: Radim Krčmář
  Cc: kvm-riscv, Lukas Gerlach, Atish Patra, Paul Walmsley,
	Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Andrew Jones, kvm,
	linux-riscv, linux-kernel

On Fri, Feb 27, 2026 at 7:20 PM Radim Krčmář
<radim.krcmar@oss.qualcomm.com> wrote:
>
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
>
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>

Thanks for catching.

Reviewed-by: Anup Patel <anup@brainfault.org>

Queued this patch as fixes for Linux-7.0-rcX.

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_pmu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
> index 4d8d5e9aa53d..aec6b293968b 100644
> --- a/arch/riscv/kvm/vcpu_pmu.c
> +++ b/arch/riscv/kvm/vcpu_pmu.c
> @@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
>  {
>         struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
>
> -       if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
> +       if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
>                 retdata->err_val = SBI_ERR_INVALID_PARAM;
>                 return 0;
>         }
> --
> 2.51.2
>

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
  2026-02-27 13:46 ` Radim Krčmář
  (?)
@ 2026-03-24  6:07   ` patchwork-bot+linux-riscv
  -1 siblings, 0 replies; 9+ messages in thread
From: patchwork-bot+linux-riscv @ 2026-03-24  6:07 UTC (permalink / raw)
  To: =?utf-8?b?UmFkaW0gS3LEjW3DocWZIDxyYWRpbS5rcmNtYXJAb3NzLnF1YWxjb21tLmNvbT4=?=
  Cc: linux-riscv, kvm-riscv, lukas.gerlach, anup, atish.patra, pjw,
	palmer, aou, alex, ajones, kvm, linux-kernel

Hello:

This patch was applied to riscv/linux.git (for-next)
by Anup Patel <anup@brainfault.org>:

On Fri, 27 Feb 2026 13:46:16 +0000 you wrote:
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
> 
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
> 
> [...]

Here is the summary with links:
  - RISC-V: KVM: fix off-by-one array access in SBI PMU
    https://git.kernel.org/riscv/c/5c1bb0787111

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



-- 
kvm-riscv mailing list
kvm-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kvm-riscv

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-03-24  6:07   ` patchwork-bot+linux-riscv
  0 siblings, 0 replies; 9+ messages in thread
From: patchwork-bot+linux-riscv @ 2026-03-24  6:07 UTC (permalink / raw)
  To: =?utf-8?b?UmFkaW0gS3LEjW3DocWZIDxyYWRpbS5rcmNtYXJAb3NzLnF1YWxjb21tLmNvbT4=?=
  Cc: linux-riscv, kvm-riscv, lukas.gerlach, anup, atish.patra, pjw,
	palmer, aou, alex, ajones, kvm, linux-kernel

Hello:

This patch was applied to riscv/linux.git (for-next)
by Anup Patel <anup@brainfault.org>:

On Fri, 27 Feb 2026 13:46:16 +0000 you wrote:
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
> 
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
> 
> [...]

Here is the summary with links:
  - RISC-V: KVM: fix off-by-one array access in SBI PMU
    https://git.kernel.org/riscv/c/5c1bb0787111

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU
@ 2026-03-24  6:07   ` patchwork-bot+linux-riscv
  0 siblings, 0 replies; 9+ messages in thread
From: patchwork-bot+linux-riscv @ 2026-03-24  6:07 UTC (permalink / raw)
  To: =?utf-8?b?UmFkaW0gS3LEjW3DocWZIDxyYWRpbS5rcmNtYXJAb3NzLnF1YWxjb21tLmNvbT4=?=
  Cc: linux-riscv, kvm-riscv, lukas.gerlach, anup, atish.patra, pjw,
	palmer, aou, alex, ajones, kvm, linux-kernel

Hello:

This patch was applied to riscv/linux.git (for-next)
by Anup Patel <anup@brainfault.org>:

On Fri, 27 Feb 2026 13:46:16 +0000 you wrote:
> The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
> The out-of-bound access could have been performed by a guest, but it
> could only access another guest accessible data.
> 
> Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
> Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
> 
> [...]

Here is the summary with links:
  - RISC-V: KVM: fix off-by-one array access in SBI PMU
    https://git.kernel.org/riscv/c/5c1bb0787111

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-03-24  6:08 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-27 13:46 [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU Radim Krčmář
2026-02-27 13:46 ` Radim Krčmář
2026-02-27 13:46 ` Radim Krčmář
2026-03-02 13:10 ` Anup Patel
2026-03-02 13:10   ` Anup Patel
2026-03-02 13:10   ` Anup Patel
2026-03-24  6:07 ` patchwork-bot+linux-riscv
2026-03-24  6:07   ` patchwork-bot+linux-riscv
2026-03-24  6:07   ` patchwork-bot+linux-riscv

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.