From: sashiko-bot@kernel.org
Subject: Re: [v2 1/2] KVM: LoongArch: Validate irqchip index in irqfd
 routing
Reply-To: sashiko-reviews@lists.linux.dev
To: "Yanfei Xu" <yanfei.xu@bytedance.com>
Cc: kvm@vger.kernel.org
In-Reply-To: <20260531135326.2238555-2-yanfei.xu@bytedance.com>
References: <20260531135326.2238555-2-yanfei.xu@bytedance.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Sun, 31 May 2026 14:09:20 +0000
Message-Id: <20260531140921.1B1181F00893@smtp.kernel.org>
Precedence: bulk

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check on the `e->msi.data` value before using i=
t as an `irq` index in `eiointc_set_irq()` leads to an out-of-bounds memory=
 read and write.
--

commit 217e342828fa29f1b763464cad52ec8a004759a7
Author: Yanfei Xu <yanfei.xu@bytedance.com>

KVM: LoongArch: Validate irqchip index in irqfd routing

This commit adds validation for the irqchip index and pin in the LoongArch
KVM irqfd routing setup to prevent out-of-bounds array access.

Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel=
.org/

> diff --git a/arch/loongarch/kvm/irqfd.c b/arch/loongarch/kvm/irqfd.c
> index f4f953b224192..40ed1081c4b62 100644
> --- a/arch/loongarch/kvm/irqfd.c
> +++ b/arch/loongarch/kvm/irqfd.c
> @@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
>  		e->irqchip.irqchip =3D ue->u.irqchip.irqchip;
>  		e->irqchip.pin =3D ue->u.irqchip.pin;
> =20
> -		if (e->irqchip.pin >=3D KVM_IRQCHIP_NUM_PINS)
> +		if (e->irqchip.pin >=3D KVM_IRQCHIP_NUM_PINS ||
> +		    e->irqchip.irqchip >=3D KVM_NR_IRQCHIPS)
>  			return -EINVAL;
> =20
>  		return 0;

[Severity: Critical]
This is a pre-existing issue, but does this code also need bounds checking
for the MSI routing case?

When handling KVM_IRQ_ROUTING_MSI in kvm_set_routing_entry(), we copy the
user-controlled ue->u.msi.data into e->msi.data without any validation:

    e->msi.data =3D ue->u.msi.data;

During MSI injection, kvm_set_msi() passes this value down to
pch_msi_set_irq(), which directly uses it as the irq parameter:

    eiointc_set_irq(kvm->arch.eiointc, e->msi.data, level);

Inside eiointc_set_irq(), this untrusted value is used as an index in
bitwise operations against s->isr and passed to eiointc_update_irq():

    level ? __set_bit(irq, isr) : __clear_bit(irq, isr);
    ...
    cpu =3D s->sw_coremap[irq];

Could this allow a malicious guest or unprivileged host userspace to perform
an out-of-bounds memory read and write against the eiointc allocation?

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260531135326.2238=
555-1-yanfei.xu@bytedance.com?part=3D1