Re: [PATCH v6 07/49] KVM: arm64: gic-v5: Cache host IRS ID registers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Integer truncation in vgic_v5_irs_vped_size and vgic_v5_irs_vmd_size can lead to zero-sized allocations and host memory corruption.
--

commit 04b027d3b388107549c9e9457c0e98e85ca72ba3
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

KVM: arm64: gic-v5: Cache host IRS ID registers

This commit caches the GICv5 IRS ID registers (IRS_IDR2, IRS_IDR3, IRS_IDR4)
instead of extracting their individual fields into kvm_vgic_global_state. It
also introduces accessor helpers to derive capabilities directly from these
cached registers.

> diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
> index 086b7578e5f33..c82aa7c9e3f32 100644
> --- a/include/kvm/arm_vgic.h
> +++ b/include/kvm/arm_vgic.h
[ ... ]
> @@ -627,6 +643,65 @@ int vgic_v4_load(struct kvm_vcpu *vcpu);
[ ... ]
> +static inline u16 vgic_v5_irs_vmd_size(const struct vgic_v5_irs_caps *caps)
> +{
> +	if (!(caps->idr3 & GICV5_IRS_IDR3_VMD))
> +		return 0;
> +
> +	return BIT(FIELD_GET(GICV5_IRS_IDR3_VMD_SZ, caps->idr3));
> +}

[Severity: High]
Will this return type truncate the descriptor size to 0?

The hardware field GICV5_IRS_IDR3_VMD_SZ is 6 bits, allowing values up to 63.
If the host hardware provides a size shift >= 16, BIT() will produce a value
>= 65536. Casting this to u16 truncates it to 0.

When vgic_v5_probe() uses this size to allocate the descriptor tables, a
0-byte allocation results in a ZERO_SIZE_PTR. KVM will then program
virt_to_phys(ZERO_SIZE_PTR) into the host GIC hardware, which can cause
host physical memory corruption when the hardware accesses it.

> +
> +static inline u16 vgic_v5_irs_vped_size(const struct vgic_v5_irs_caps *caps)
> +{
> +	return BIT(FIELD_GET(GICV5_IRS_IDR4_VPED_SZ, caps->idr4));
> +}

[Severity: High]
Can the same truncation occur here?

Similar to the VMD size above, GICV5_IRS_IDR4_VPED_SZ is a 6-bit field. If
the hardware reports a shift >= 16, BIT() produces a value that truncates
to 0 in a u16 return type, leading to the same zero-sized allocation issue
when programming the Virtual PE Descriptor size.

> +
> +static inline u32 vgic_v5_irs_max_vpes(const struct vgic_v5_irs_caps *caps)
> +{
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904113404.4051341-1-sascha.bischoff@arm.com?part=7