Re: [PATCH v6 1/6] LoongArch: KVM: Check irq validility in kvm_vcpu_ioctl_interrupt()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Un-ratelimited `kvm_err` enables host log flooding DoS from unprivileged userspace, and valid IRQ 0 (`INT_SWI0`) cannot be queued or dequeued.
--

commit fd892c086057b77e1ae791d2e1126c1532b41bbb
Author: Bibo Mao <maobibo@loongson.cn>

LoongArch: KVM: Check irq validility in kvm_vcpu_ioctl_interrupt()

This commit adds validity checking for the interrupt vector in
kvm_vcpu_ioctl_interrupt(), returning an error if it exceeds
EXCCODE_INT_NUM.

> diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
> index e28084c49e682..df5be9b265e8d 100644
> --- a/arch/loongarch/kvm/vcpu.c
> +++ b/arch/loongarch/kvm/vcpu.c
> @@ -1487,6 +1487,11 @@ void kvm_lose_fpu(struct kvm_vcpu *vcpu)
>  int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, struct kvm_interrupt *irq)
>  {
>  	int intr = (int)irq->irq;
> +	unsigned int vector;
> +
> +	vector = abs(intr);
> +	if (vector >= EXCCODE_INT_NUM)
> +		return -EINVAL;
>  
>  	if (intr > 0)
>  		kvm_queue_irq(vcpu, intr);

[Severity: High]
This is a pre-existing issue, but looking at the rest of
kvm_vcpu_ioctl_interrupt(), if irq->irq is 0 (which corresponds to INT_SWI0),
both the intr > 0 and intr < 0 checks are skipped.

The code then falls through to the following else block:

    else {
        kvm_err("%s: invalid interrupt ioctl %d\n", __func__, irq->irq);
        return -EINVAL;
    }

Since kvm_err() is not rate-limited, can an unprivileged userspace process
holding a vCPU file descriptor call this ioctl in a tight loop with
irq->irq = 0 to rapidly flood the host kernel log?

Could this create a denial of service by locking up the system via a
serial console or exhausting disk space?

Also, does this logic fundamentally prevent userspace from correctly
queuing or dequeuing INT_SWI0?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611065815.1439154-1-maobibo@loongson.cn?part=1