Re: [v2 1/2] KVM: LoongArch: Validate irqchip index in irqfd routing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check on the `e->msi.data` value before using it as an `irq` index in `eiointc_set_irq()` leads to an out-of-bounds memory read and write.
--

commit 217e342828fa29f1b763464cad52ec8a004759a7
Author: Yanfei Xu <yanfei.xu@bytedance.com>

KVM: LoongArch: Validate irqchip index in irqfd routing

This commit adds validation for the irqchip index and pin in the LoongArch
KVM irqfd routing setup to prevent out-of-bounds array access.

Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/

> diff --git a/arch/loongarch/kvm/irqfd.c b/arch/loongarch/kvm/irqfd.c
> index f4f953b224192..40ed1081c4b62 100644
> --- a/arch/loongarch/kvm/irqfd.c
> +++ b/arch/loongarch/kvm/irqfd.c
> @@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
>  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
>  		e->irqchip.pin = ue->u.irqchip.pin;
>  
> -		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
> +		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
> +		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
>  			return -EINVAL;
>  
>  		return 0;

[Severity: Critical]
This is a pre-existing issue, but does this code also need bounds checking
for the MSI routing case?

When handling KVM_IRQ_ROUTING_MSI in kvm_set_routing_entry(), we copy the
user-controlled ue->u.msi.data into e->msi.data without any validation:

    e->msi.data = ue->u.msi.data;

During MSI injection, kvm_set_msi() passes this value down to
pch_msi_set_irq(), which directly uses it as the irq parameter:

    eiointc_set_irq(kvm->arch.eiointc, e->msi.data, level);

Inside eiointc_set_irq(), this untrusted value is used as an index in
bitwise operations against s->isr and passed to eiointc_update_irq():

    level ? __set_bit(irq, isr) : __clear_bit(irq, isr);
    ...
    cpu = s->sw_coremap[irq];

Could this allow a malicious guest or unprivileged host userspace to perform
an out-of-bounds memory read and write against the eiointc allocation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260531135326.2238555-1-yanfei.xu@bytedance.com?part=1