Re: [PATCH v6 35/49] KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM fails to validate that restored pending LPIs have a valid IntID (>= 8192), allowing userspace to inject out-of-range LPIs into the hardware.
--

commit f80500170eda967b08d4456f691f187bea6f8d97
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs

This commit introduces the ability to save and restore Interrupt State Tables
(ISTs) for SPIs and LPIs in a GICv5 VM. Userspace provides migration storage
via KVM_DEV_ARM_VGIC_GRP_IST, and KVM handles copying the state between the
GICv5 hardware and these buffers while ensuring the VM remains quiesced.

> diff --git a/arch/arm64/kvm/vgic/vgic-v5-tables.c b/arch/arm64/kvm/vgic/vgic-v5-tables.c
> --- a/arch/arm64/kvm/vgic/vgic-v5-tables.c
> +++ b/arch/arm64/kvm/vgic/vgic-v5-tables.c
[ ... ]
> +static int vgic_v5_process_iste(__le32 *iste, struct list_head *pending_irqs,
> +				u32 intid, u32 type)
> +{
> +	u32 iste_data = le32_to_cpu(READ_ONCE(*iste));
> +	int ret;
> +
> +	/* Pending state is replayed later with VDPEND. */
> +	if (iste_data & GICV5_ISTL2E_PENDING) {
> +		ret = vgic_v5_track_pending_irq(pending_irqs, intid, type);

[Severity: High]
Can userspace inject an out-of-range LPI by restoring a buffer with the
pending bit set for an invalid index?

When restoring the IST via KVM_DEV_ARM_VGIC_GRP_IST, KVM scans the
userspace-provided buffer and calls vgic_v5_process_iste(). If the
pending bit is set, it tracks the interrupt for later replay. However,
there does not appear to be a check to ensure that the intid is within
the valid range for LPIs (e.g., >= 8192).

Executing a vdpend instruction with an LPI identifier less than 8192 is
architecturally unpredictable. Could this allow a malicious userspace
process to trigger a synchronous exception or SError at EL2, taking
down the host hypervisor?

> +		if (ret)
> +			return ret;
> +	}
> +
> +	iste_data &= ~GICV5_ISTL2E_PENDING;
> +	iste_data &= ~GICV5_ISTL2E_HWU;
> +
> +	WRITE_ONCE(*iste, cpu_to_le32(iste_data));
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904113404.4051341-1-sascha.bischoff@arm.com?part=35