[PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate()

[PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate()

[Karl Mehltretter]

vgic_v2_deactivate() passes the INTID from a trapped GICV_DIR write to
vgic_get_vcpu_irq() without checking it against the number of
implemented interrupts. An out-of-range INTID makes the lookup return
NULL and triggers WARN_ON_ONCE(!irq).

A guest using EOImode=1 can therefore raise a host warning, or panic a
host with panic_on_warn=1.

The GICv3 counterpart rejects INTIDs outside the configured SGI, PPI and
SPI range before performing the lookup. Add the same check to the GICv2
path.

Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 arch/arm64/kvm/vgic/vgic-v2.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c
index cafa3cb32bda..42430c0fee07 100644
--- a/arch/arm64/kvm/vgic/vgic-v2.c
+++ b/arch/arm64/kvm/vgic/vgic-v2.c
@@ -163,8 +163,12 @@ void vgic_v2_deactivate(struct kvm_vcpu *vcpu, u32 val)
 	cpuid = FIELD_GET(GENMASK_ULL(12, 10), val);
 	val &= ~GENMASK_ULL(12, 10);
 
-	/* We only deal with DIR when EOIMode==1 */
-	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK))
+	/*
+	 * We only deal with DIR when EOIMode==1, and only for SGI,
+	 * PPI or SPI.
+	 */
+	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK) ||
+	    val >= vcpu->kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)
 		return;
 
 	/* Make sure we're in the same context as LR handling */
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate()

[Marc Zyngier]

On Sat, 25 Jul 2026 16:40:20 +0100,
Karl Mehltretter <kmehltretter@gmail.com> wrote:
> 
> vgic_v2_deactivate() passes the INTID from a trapped GICV_DIR write to
> vgic_get_vcpu_irq() without checking it against the number of
> implemented interrupts. An out-of-range INTID makes the lookup return
> NULL and triggers WARN_ON_ONCE(!irq).
> 
> A guest using EOImode=1 can therefore raise a host warning, or panic a
> host with panic_on_warn=1.
> 
> The GICv3 counterpart rejects INTIDs outside the configured SGI, PPI and
> SPI range before performing the lookup. Add the same check to the GICv2
> path.
>
> Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>  arch/arm64/kvm/vgic/vgic-v2.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c
> index cafa3cb32bda..42430c0fee07 100644
> --- a/arch/arm64/kvm/vgic/vgic-v2.c
> +++ b/arch/arm64/kvm/vgic/vgic-v2.c
> @@ -163,8 +163,12 @@ void vgic_v2_deactivate(struct kvm_vcpu *vcpu, u32 val)
>  	cpuid = FIELD_GET(GENMASK_ULL(12, 10), val);
>  	val &= ~GENMASK_ULL(12, 10);
>  
> -	/* We only deal with DIR when EOIMode==1 */
> -	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK))
> +	/*
> +	 * We only deal with DIR when EOIMode==1, and only for SGI,
> +	 * PPI or SPI.
> +	 */
> +	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK) ||
> +	    val >= vcpu->kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)
>  		return;

This duplicates the existing check, as GICv2 has no LPIs. I'd rather
drop the WARN_ON() altogether.

Thanks,

	M.

-- 
Jazz isn't dead. It just smells funny.