[PATCH] LoongArch: KVM: Initialize vector array in dmsintc_inject_irq()

[Naveed Khan <naveed@digiscrypt.com>]

dmsintc_inject_irq() declares the on-stack array 'vector[4]' without an
initializer and only assigns an element when the corresponding
ds->vector_map[] word is non-zero:

	unsigned long vector[4], old;
	...
	for (i = 0; i < 4; i++) {
		old = atomic64_read(&(ds->vector_map[i]));
		if (old)
			vector[i] = atomic64_xchg(&(ds->vector_map[i]), 0);
	}

It then reads all four elements unconditionally to decide whether to OR
them into the guest CSR registers LOONGARCH_CSR_ISR0..ISR3:

	if (vector[0]) { ... }
	if (vector[1]) { ... }
	...

When a vector_map word is zero, the matching vector[] element is left
uninitialized. Its stale stack contents are then written into the
guest-visible ISR registers, both leaking kernel stack data to the guest
(which can read the ISR CSRs) and injecting spurious interrupt vectors.

The path is guest reachable: a guest-directed MSI sets bits in
vector_map via dmsintc_deliver_msi_to_vcpu(), and AVEC delivery
(kvm_irq_deliver() -> dmsintc_inject_irq()) then consumes the
partially-initialized array. In the common case where the guest only
uses low vectors, only vector_map[0] is set and vector[1..3] are read
uninitialized on every injection.

Zero-initialize the array so that words with no pending vectors are
skipped as intended.

Signed-off-by: Naveed Khan <naveed@digiscrypt.com>
---
diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index de25735ce0..ef6c064e52 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -11,7 +11,7 @@
 void dmsintc_inject_irq(struct kvm_vcpu *vcpu)
 {
 	unsigned int i;
-	unsigned long vector[4], old;
+	unsigned long vector[4] = {}, old;
 	struct dmsintc_state *ds = &vcpu->arch.dmsintc_state;
 
 	if (!ds)
-- 
2.52.0