From: Tao Cui <cui.tao@linux.dev>
To: zhaotianrui@loongson.cn, maobibo@loongson.cn, chenhuacai@kernel.org
Cc: kernel@xen0n.name, lixianglai@loongson.cn, kvm@vger.kernel.org,
loongarch@lists.linux.dev, linux-kernel@vger.kernel.org,
stable@vger.kernel.org, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 0/2] LoongArch: KVM: EIOINTC: fix INT_ENCODE ipnum out-of-bounds access
Date: Tue, 14 Jul 2026 09:24:50 +0800 [thread overview]
Message-ID: <20260714012452.1021833-1-cui.tao@linux.dev> (raw)
From: Tao Cui <cuitao@kylinos.cn>
This small series fixes a guest-triggerable out-of-bounds access in the
LoongArch KVM EIOINTC emulation, then factors the duplicated IP-number
decode into a helper.
The IP-number decode in eiointc_set_sw_coreisr() and eiointc_update_irq()
bounds ipnum only in the default (1-hot) mode. In INT_ENCODE mode the raw
ipmap byte (0..255) is used to index sw_coreisr[cpu][ipnum], whose second
dimension is LOONGSON_IP_NUM (8), so any ipmap byte >= 8 reads/writes past
the array. The value is guest-programmable through the EIOINTC virtual
extension (VIRT_CONFIG enables INT_ENCODE and the IPMAP IOCSR write is not
validated) and is also restored from a migration stream via the
LOAD_FINISHED control attribute, so this is a host slab out-of-bounds
access reachable from an unprivileged guest.
Patch 1 is the minimal, stable-bound fix: clamp ipnum to [0, LOONGSON_IP_NUM)
in INT_ENCODE mode at both call sites. Patch 2 is a follow-up cleanup that
extracts the now-identical decode into eiointc_get_ipnum() (no functional
change); it is split out so the fix stays surgical for backporting.
Verified with KASAN on Loongson-3A6000: the device-attr restore sequence
(INT_ENCODE + ipmap byte 0x80 + LOAD_FINISHED) reports
"BUG: KASAN: slab-out-of-bounds in eiointc_set_sw_coreisr" without the
series and is clean with it.
Patch 1 carries Fixes:/Cc: stable; patch 2 is mainline-only.
Tao Cui (2):
LoongArch: KVM: EIOINTC: clamp ipnum to valid range in INT_ENCODE mode
LoongArch: KVM: EIOINTC: factor IP-number decode into a helper
arch/loongarch/kvm/intc/eiointc.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
--
2.43.0
next reply other threads:[~2026-07-14 1:25 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 1:24 Tao Cui [this message]
2026-07-14 1:24 ` [PATCH 1/2] LoongArch: KVM: EIOINTC: clamp ipnum to valid range in INT_ENCODE mode Tao Cui
2026-07-14 1:39 ` sashiko-bot
2026-07-14 2:32 ` Bibo Mao
2026-07-14 3:19 ` Tao Cui
2026-07-14 1:24 ` [PATCH 2/2] LoongArch: KVM: EIOINTC: factor IP-number decode into a helper Tao Cui
2026-07-14 1:37 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260714012452.1021833-1-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lixianglai@loongson.cn \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=stable@vger.kernel.org \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.