Re: [PATCH 2/2] LoongArch: KVM: EIOINTC: factor IP-number decode into a helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check on untrusted guest-controlled MSI data (`e->msi.data`) allows out-of-bounds array accesses and arbitrary host memory corruption.
--

--- Patch [2]: [PATCH 2/2] LoongArch: KVM: EIOINTC: factor IP-number decode into a helper ---
commit 819d482a674f6e7813eb24d40a7c6711789b26a8
Author: Tao Cui <cuitao@kylinos.cn>

LoongArch: KVM: EIOINTC: factor IP-number decode into a helper

This commit factors the ipmap IP-number decoding logic, which was previously
duplicated in eiointc_set_sw_coreisr() and eiointc_update_irq(), into a new
helper function named eiointc_get_ipnum().

> diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
> index 0c34d7ab264dc..c1e0cd8dca16c 100644
> --- a/arch/loongarch/kvm/intc/eiointc.c
> +++ b/arch/loongarch/kvm/intc/eiointc.c
> @@ -7,19 +7,27 @@
>  #include <asm/kvm_vcpu.h>
>  #include <linux/count_zeros.h>
>  
> +static int eiointc_get_ipnum(struct loongarch_eiointc *s, int irq)
> +{
> +	int ipnum = (s->ipmap >> (irq / 32 * 8)) & 0xff;

[Severity: Critical]
This is a pre-existing issue, but does this bit shift result in undefined
behavior if an out-of-bounds irq is provided?

If a malicious guest or userspace provides an unvalidated MSI data payload,
it is passed as the irq parameter through the following call chain:

kvm_send_userspace_msi() -> kvm_set_msi() -> pch_msi_set_irq()

pch_msi_set_irq() {
    ...
    eiointc_set_irq(kvm->arch.eiointc, e->msi.data, level);
}

The unvalidated irq is used in the bit shift above, and also leads to
out-of-bounds array reads in eiointc_update_irq():

    cpu = s->sw_coremap[irq];

Could this also allow arbitrary host memory corruption when setting bits in
eiointc_set_irq() since isr is bounded to EIOINTC_IRQS?

    level ? __set_bit(irq, isr) : __clear_bit(irq, isr);

> +
> +	if (!(s->status & BIT(EIOINTC_ENABLE_INT_ENCODE))) {
> +		ipnum = count_trailing_zeros(ipnum);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714012452.1021833-1-cui.tao@linux.dev?part=2