Re: [PATCH v6 4/6] LoongArch: KVM: Inject interrupt with batch method

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uninitialized stack array `vector` is accessed conditionally in `dmsintc_inject_irq`, potentially leading to hardware state corruption.
--

commit 1bbf844f12dc29aa2ddec056c816e1245e63e5fb
Author: Bibo Mao <maobibo@loongson.cn>

    LoongArch: KVM: Inject interrupt with batch method

This commit converts interrupt injection and clearing to process multiple
interrupts simultaneously using a bitmask instead of one-by-one based on
priorities. It also removes the unused priority_to_irq array.

> diff --git a/arch/loongarch/kvm/interrupt.c b/arch/loongarch/kvm/interrupt.c
> index 48dd56aa4dc56..c1afeb058c5b3 100644
> --- a/arch/loongarch/kvm/interrupt.c
> +++ b/arch/loongarch/kvm/interrupt.c
[ ... ]
> -static int kvm_irq_deliver(struct kvm_vcpu *vcpu, unsigned int priority)
> +static void kvm_irq_deliver(struct kvm_vcpu *vcpu, unsigned long mask)
>  {
> -	unsigned int irq = 0;
> +	unsigned long irq;
>  	unsigned long old, new;
>  
> -	clear_bit(priority, &vcpu->arch.irq_pending);
> -	if (priority < EXCCODE_INT_NUM)
> -		irq = priority_to_irq[priority];
> -
> -	switch (priority) {
> -	case INT_AVEC:
> -		dmsintc_inject_irq(vcpu);
> -		fallthrough;
> -	case INT_TI:
> -	case INT_IPI:
> -	case INT_SWI0:
> -	case INT_SWI1:
> +	irq = mask & KVM_ESTAT_INTI_MASK;
> +	if (irq) {
> +		if (irq & CPU_AVEC)
> +			dmsintc_inject_irq(vcpu);

[Severity: High]
This is a pre-existing issue, but does dmsintc_inject_irq() use an
uninitialized stack array?

Looking at dmsintc_inject_irq() in arch/loongarch/kvm/intc/dmsintc.c, the
array vector is declared without initialization:

arch/loongarch/kvm/intc/dmsintc.c:dmsintc_inject_irq() {
	unsigned int i;
	unsigned long vector[4], old;
	...
	for (i = 0; i < 4; i++) {
		old = atomic64_read(&(ds->vector_map[i]));
		if (old)
			vector[i] = atomic64_xchg(&(ds->vector_map[i]), 0);
	}

If old is zero, vector[i] is left uninitialized. Then later the
uninitialized memory is evaluated:

	if (vector[0]) {
		old = kvm_read_hw_gcsr(LOONGARCH_CSR_ISR0);
		kvm_write_hw_gcsr(LOONGARCH_CSR_ISR0, vector[0] | old);
	}
	...

Can this unpredictably corrupt the guest's interrupt state machine and
potentially cause guest kernel panics by writing garbage values to the
hardware CSR?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611065815.1439154-1-maobibo@loongson.cn?part=4