Re: [PATCH v5 20/21] KVM: selftests: Make number of vCPUs configurable in IRQ test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing bounds check on user-supplied `nr_vcpus` allows stack buffer overflows and out-of-bounds global array accesses.
--

commit 115e22303a8d11509c805d6bfdcdbd39b670c16d
Author: David Matlack <dmatlack@google.com>

KVM: selftests: Make number of vCPUs configurable in IRQ test

This commit adds a '-v' flag to tools/testing/selftests/kvm/irq_test.c,
allowing users to configure the number of vCPUs to run in the test.

> diff --git a/tools/testing/selftests/kvm/irq_test.c b/tools/testing/selftests/kvm/irq_test.c
> index 1d66293b6d0b8..41c50caa928e2 100644
> --- a/tools/testing/selftests/kvm/irq_test.c
> +++ b/tools/testing/selftests/kvm/irq_test.c
[ ... ]
> @@ -213,6 +214,9 @@ int main(int argc, char **argv)
>  		case 'n':
>  			use_nmi = true;
>  			break;
> +		case 'v':
> +			nr_vcpus = atoi_positive("Number of vCPUS", optarg);

[Severity: Medium]
Does this code need a bounds check for nr_vcpus against KVM_MAX_VCPUS?

Because vcpu_threads and vcpus are fixed-size stack arrays in main():

	pthread_t vcpu_threads[KVM_MAX_VCPUS];
	struct kvm_vcpu *vcpus[KVM_MAX_VCPUS];

if the user specifies a value larger than KVM_MAX_VCPUS, won't it cause a
stack buffer overflow when passing vcpus to vm_create_with_vcpus() or
subsequently populating the vcpu_threads array?

> +			break;
>  		case 'h':
>  		default:
>  			help(argv[0]);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604020143.748245-1-jrhilke@google.com?part=20