Re: [PATCH 37/60] kvm: Pass plane_level to kvm_set_routing_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `plane_level` field in the stack-allocated `route` structure in `kvm_send_userspace_msi()` is left uninitialized, leading to unpredictable routing.
--

commit c0cc00a54b6971a99bf9346816eca0f0b3372493
Author: Joerg Roedel <joerg.roedel@amd.com>

The plane_level is used to route MSI IRQs to the correct plane.

This patch updates the KVM routing entry setup to include a plane_level
parameter. It modifies kvm_set_routing_entry across multiple architectures
to pass this target plane level for MSI IRQ routing.

[ ... ]

> diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
> index ae47e56176f1..14480d1df4f9 100644
> --- a/virt/kvm/irqchip.c
> +++ b/virt/kvm/irqchip.c
> @@ -146,7 +146,7 @@ static int setup_routing_entry(struct kvm *kvm,
>  
>  	e->gsi = gsi;
>  	e->type = ue->type;
> -	r = kvm_set_routing_entry(kvm, e, ue);
> +	r = kvm_set_routing_entry(kvm, e, ue, 0);

[Severity: High]
Does this routing change leave route.msi.plane_level uninitialized in
kvm_send_userspace_msi() when handling the KVM_SIGNAL_MSI ioctl?

Looking at virt/kvm/irqchip.c:kvm_send_userspace_msi():

	struct kvm_kernel_irq_routing_entry route;

	if (!kvm_arch_irqchip_in_kernel(kvm) || (msi->flags & ~KVM_MSI_VALID_DEVID))
		return -EINVAL;

	route.msi.address_lo = msi->address_lo;
	route.msi.address_hi = msi->address_hi;
	route.msi.data = msi->data;
	route.msi.flags = msi->flags;
	route.msi.devid = msi->devid;

	return kvm_set_msi(&route, kvm, KVM_USERSPACE_IRQ_SOURCE_ID, 1, false);

Since the struct kvm_kernel_irq_routing_entry is allocated on the stack and
isn't zero-initialized, and plane_level isn't explicitly set here, could
route.msi.plane_level contain garbage stack data before it is passed to
kvm_set_msi()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608144252.351443-1-joro@8bytes.org?part=37