Re: [PATCH v6 07/49] KVM: arm64: gic-v5: Cache host IRS ID registers

[Sascha Bischoff <Sascha.Bischoff@arm.com>]

On Fri, 2026-09-04 at 12:25 +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider:
> - [High] Integer truncation in vgic_v5_irs_vped_size and
> vgic_v5_irs_vmd_size can lead to zero-sized allocations and host
> memory corruption.
> --
> 
> commit 04b027d3b388107549c9e9457c0e98e85ca72ba3
> Author: Sascha Bischoff <Sascha.Bischoff@arm.com>
> 
> KVM: arm64: gic-v5: Cache host IRS ID registers
> 
> This commit caches the GICv5 IRS ID registers (IRS_IDR2, IRS_IDR3,
> IRS_IDR4)
> instead of extracting their individual fields into
> kvm_vgic_global_state. It
> also introduces accessor helpers to derive capabilities directly from
> these
> cached registers.
> 
> > diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
> > index 086b7578e5f33..c82aa7c9e3f32 100644
> > --- a/include/kvm/arm_vgic.h
> > +++ b/include/kvm/arm_vgic.h
> [ ... ]
> > @@ -627,6 +643,65 @@ int vgic_v4_load(struct kvm_vcpu *vcpu);
> [ ... ]
> > +static inline u16 vgic_v5_irs_vmd_size(const struct
> > vgic_v5_irs_caps *caps)
> > +{
> > +	if (!(caps->idr3 & GICV5_IRS_IDR3_VMD))
> > +		return 0;
> > +
> > +	return BIT(FIELD_GET(GICV5_IRS_IDR3_VMD_SZ, caps->idr3));
> > +}
> 
> [Severity: High]
> Will this return type truncate the descriptor size to 0?
> 
> The hardware field GICV5_IRS_IDR3_VMD_SZ is 6 bits, allowing values
> up to 63.
> If the host hardware provides a size shift >= 16, BIT() will produce
> a value
> > = 65536. Casting this to u16 truncates it to 0.

No: The minimum valid value for this field is 3 and the maximum valid
value is 12.

> 
> When vgic_v5_probe() uses this size to allocate the descriptor
> tables, a
> 0-byte allocation results in a ZERO_SIZE_PTR. KVM will then program
> virt_to_phys(ZERO_SIZE_PTR) into the host GIC hardware, which can
> cause
> host physical memory corruption when the hardware accesses it.
> 
> > +
> > +static inline u16 vgic_v5_irs_vped_size(const struct
> > vgic_v5_irs_caps *caps)
> > +{
> > +	return BIT(FIELD_GET(GICV5_IRS_IDR4_VPED_SZ, caps->idr4));
> > +}
> 
> [Severity: High]
> Can the same truncation occur here?
> 
> Similar to the VMD size above, GICV5_IRS_IDR4_VPED_SZ is a 6-bit
> field. If
> the hardware reports a shift >= 16, BIT() produces a value that
> truncates
> to 0 in a u16 return type, leading to the same zero-sized allocation
> issue
> when programming the Virtual PE Descriptor size.

No: The minimum valid value for this field is 3 and the maximum valid
value is 12.
> 
> > +
> > +static inline u32 vgic_v5_irs_max_vpes(const struct
> > vgic_v5_irs_caps *caps)
> > +{
> [ ... ]
> 

Thanks,
Sascha