From: Tao Cui <cui.tao@linux.dev>
To: zhaotianrui@loongson.cn, maobibo@loongson.cn, chenhuacai@kernel.org
Cc: kernel@xen0n.name, lixianglai@loongson.cn, kvm@vger.kernel.org,
loongarch@lists.linux.dev, linux-kernel@vger.kernel.org,
stable@vger.kernel.org, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 0/2] LoongArch: KVM: EIOINTC: fix INT_ENCODE ipnum out-of-bounds access
Date: Tue, 14 Jul 2026 09:24:50 +0800 [thread overview]
Message-ID: <20260714012452.1021833-1-cui.tao@linux.dev> (raw)
From: Tao Cui <cuitao@kylinos.cn>
This small series fixes a guest-triggerable out-of-bounds access in the
LoongArch KVM EIOINTC emulation, then factors the duplicated IP-number
decode into a helper.
The IP-number decode in eiointc_set_sw_coreisr() and eiointc_update_irq()
bounds ipnum only in the default (1-hot) mode. In INT_ENCODE mode the raw
ipmap byte (0..255) is used to index sw_coreisr[cpu][ipnum], whose second
dimension is LOONGSON_IP_NUM (8), so any ipmap byte >= 8 reads/writes past
the array. The value is guest-programmable through the EIOINTC virtual
extension (VIRT_CONFIG enables INT_ENCODE and the IPMAP IOCSR write is not
validated) and is also restored from a migration stream via the
LOAD_FINISHED control attribute, so this is a host slab out-of-bounds
access reachable from an unprivileged guest.
Patch 1 is the minimal, stable-bound fix: clamp ipnum to [0, LOONGSON_IP_NUM)
in INT_ENCODE mode at both call sites. Patch 2 is a follow-up cleanup that
extracts the now-identical decode into eiointc_get_ipnum() (no functional
change); it is split out so the fix stays surgical for backporting.
Verified with KASAN on Loongson-3A6000: the device-attr restore sequence
(INT_ENCODE + ipmap byte 0x80 + LOAD_FINISHED) reports
"BUG: KASAN: slab-out-of-bounds in eiointc_set_sw_coreisr" without the
series and is clean with it.
Patch 1 carries Fixes:/Cc: stable; patch 2 is mainline-only.
Tao Cui (2):
LoongArch: KVM: EIOINTC: clamp ipnum to valid range in INT_ENCODE mode
LoongArch: KVM: EIOINTC: factor IP-number decode into a helper
arch/loongarch/kvm/intc/eiointc.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
--
2.43.0
next reply other threads:[~2026-07-14 1:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 1:24 Tao Cui [this message]
2026-07-14 1:24 ` [PATCH 1/2] LoongArch: KVM: EIOINTC: clamp ipnum to valid range in INT_ENCODE mode Tao Cui
2026-07-14 2:32 ` Bibo Mao
2026-07-14 3:19 ` Tao Cui
2026-07-14 1:24 ` [PATCH 2/2] LoongArch: KVM: EIOINTC: factor IP-number decode into a helper Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260714012452.1021833-1-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lixianglai@loongson.cn \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=stable@vger.kernel.org \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox