Re: [PATCH v5 2/5] LoongArch: KVM: Return directly when IPI address is not aligned

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Guest-triggerable host log spam (Denial of Service) via un-ratelimited `kvm_err` calls across multiple IPI and interrupt controller handlers.
--

--- Patch [2]: [PATCH v5 2/5] LoongArch: KVM: Return directly when IPI address is not aligned ---
commit ee58d22f0a0ca959fcdaed9af721908e0d1dcd00
Author: Bibo Mao <maobibo@loongson.cn>

LoongArch: KVM: Return directly when IPI address is not aligned

When an IPI address is not aligned with its access size, the code now returns
directly in read/write operations and prints a ratelimited message instead of
emitting a warning. This matches the behavior of in-kernel extioi and pch_pic
operations.

> diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
> index 4fa0897d7bdb0..928f9bd5e1f12 100644
> --- a/arch/loongarch/kvm/intc/ipi.c
> +++ b/arch/loongarch/kvm/intc/ipi.c
> @@ -186,9 +186,13 @@ static int loongarch_ipi_readl(struct kvm_vcpu *vcpu, gpa_t addr, int len, void
>  	uint32_t offset;
>  	uint64_t res = 0;
>  
> -	offset = (uint32_t)(addr & 0x1ff);
> -	WARN_ON_ONCE(offset & (len - 1));
> +	if (addr & (len - 1)) {
> +		*(uint64_t *)val = res;
> +		kvm_pr_unimpl("%s: ipi not aligned addr %llx len %d\n", __func__, addr, len);
> +		return 0;
> +	}

[Severity: High]
This is a pre-existing issue, but while you are using the ratelimited 
kvm_pr_unimpl() here, there appear to be other un-ratelimited error prints 
triggered by guest actions in these handlers.

For example, when a guest performs accesses to unknown offsets or provides 
invalid CPU IDs, the code uses kvm_err():

arch/loongarch/kvm/intc/ipi.c:loongarch_ipi_readl() and loongarch_ipi_writel()
    kvm_err("%s: unknown addr: %llx\n", __func__, addr);

arch/loongarch/kvm/intc/ipi.c:any_send()
    kvm_err("%s: invalid target cpu: %d\n", __func__, cpu);

arch/loongarch/kvm/intc/eiointc.c:kvm_eiointc_read()
    kvm_err("%s: eiointc not aligned addr %llx len %d\n", __func__, addr, len);

Can an untrusted guest flood the host's dmesg by repeatedly triggering these 
conditions, potentially causing a host denial of service? Would it be safer 
to convert these to ratelimited prints as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714072520.2745942-1-maobibo@loongson.cn?part=2