Re: [PATCH v4 3/4] LoongArch: KVM: Return directly when IPI address is not aligned

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The early return path for unaligned accesses in `loongarch_ipi_readl` fails to populate the `val` output parameter, leaking stale data to the guest.

Pre-existing issues:
- [Critical] A malicious guest can trigger a host kernel panic by performing an unaligned MMIO access to the MIPS KVM IPI region.
--

--- Patch [3]: [PATCH v4 3/4] LoongArch: KVM: Return directly when IPI address is not aligned ---
commit 8225fc6b95e2b4712a3ffe27c14012171a25b47b
Author: Bibo Mao <maobibo@loongson.cn>

LoongArch: KVM: Return directly when IPI address is not aligned

This patch modifies KVM on LoongArch to return directly from IPI read and
write operations when the address is unaligned, rather than just printing a
warning.

> diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
> index bccdfd963e5b5..8ec40e09c5abb 100644
> --- a/arch/loongarch/kvm/intc/ipi.c
> +++ b/arch/loongarch/kvm/intc/ipi.c
> @@ -181,9 +181,12 @@ static int loongarch_ipi_readl(struct kvm_vcpu *vcpu, gpa_t addr, int len, void
>  	uint32_t offset;
>  	uint64_t res = 0;
>  
> -	offset = (uint32_t)(addr & 0x1ff);
> -	WARN_ON_ONCE(offset & (len - 1));
> +	if (addr & (len - 1)) {
> +		kvm_pr_unimpl("%s: ipi not aligned addr %llx len %d\n", __func__, addr, len);
> +		return 0;
> +	}

[Severity: High]
Does this early return path in loongarch_ipi_readl() need to populate the val
output parameter before returning success (0)?

If a guest performs an unaligned read, kvm_io_bus_read() will see a successful
return, but val remains unmodified. Could this lead to stale data from
previous VM exits being copied into the guest's registers?

[ ... ]

[Severity: Critical]
This is a pre-existing issue and was not introduced by this patch, but while
reviewing unaligned IPI access handling, a guest-triggerable BUG_ON() was
noticed in the MIPS loongson_vipi_read() and loongson_vipi_write() paths:

arch/mips/kvm/loongson_ipi.c:loongson_vipi_read() {
    ...
    BUG_ON(offset & (len - 1));
    ...
}

Could a malicious guest trigger a host kernel panic by performing an unaligned
MMIO read or write targeting the loongson_ipi region?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709082109.1361767-1-maobibo@loongson.cn?part=3