KVM: Validate irqchip index in routing entries

PATCH Applied Yanfei Xu 6 participants 9 messages May 31 – Aug 6

Subsystems (6)

Stable branch KVM PowerPC KVM PowerPC +2 more subsystems

lore

Share & tools

lore

Yanfei Xu

author

2026-05-31 13:53 UTC #0 lore raw

v2 cover KVM: Validate irqchip index in routing entries

Validate irqchip indexes for LoongArch and PowerPC irq routing entries to reject out-of-range values before indexing the irqchip array.

v1->v2:
- Split the patch into two by architecture (Sean)
- Pick up Reviewed-by

Yanfei Xu (2):
KVM: LoongArch: Validate irqchip index in irqfd routing
KVM: PPC: Validate irqchip index in MPIC routing

 arch/loongarch/kvm/irqfd.c | 3 ++-
 arch/powerpc/kvm/mpic.c    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

Signature · 1 line

2.20.1

Yanfei Xu

author

2026-05-31 13:54 UTC #1 lore raw

PATCH v2 1/2 KVM: LoongArch: Validate irqchip index in irqfd routing

Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array.

Fixes 1928254c5ccb ("LoongArch: KVM: Add irqfd support")

Reported-by Sashiko <[email protected]>

Closes https://lore.kernel.org/kvm/[email protected]/ open here

Reviewed-by Bibo Mao <[email protected]>

Signed-off-by Yanfei Xu <[email protected]>

---
 arch/loongarch/kvm/irqfd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/loongarch/kvm/irqfd.c +2 -1

index f4f953b22419..40ed1081c4b6 100644
@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin;
 
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
 			return -EINVAL;
 
 		return 0;

Signature · 1 line

2.20.1

[email protected]

AI review

2026-05-31 14:09 UTC #2 lore raw

Re: [v2 1/2] KVM: LoongArch: Validate irqchip index in irqfd routing

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check on the e->msi.data value before using it as an irq index in eiointc_set_irq() leads to an out-of-bounds memory read and write. --

commit 217e342828fa29f1b763464cad52ec8a004759a7
Author: Yanfei Xu <[email protected]>

KVM: LoongArch: Validate irqchip index in irqfd routing

This commit adds validation for the irqchip index and pin in the LoongArch KVM irqfd routing setup to prevent out-of-bounds array access.

Closes https://lore.kernel.org/kvm/[email protected]/ open here

Quoted 5 lines

arch/loongarch/kvm/irqfd.c +0 -0
index f4f953b224192..40ed1081c4b62 100644

arch/loongarch/kvm/irqfd.c int kvm_set_routing_entry(struct kvm *kvm, · line 58

Quoted 9 lines

arch/loongarch/kvm/irqfd.c +2 -1

@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin;
 
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
 			return -EINVAL;
 
 		return 0;

[Severity: Critical]
This is a pre-existing issue, but does this code also need bounds checking for the MSI routing case?

When handling KVM_IRQ_ROUTING_MSI in kvm_set_routing_entry(), we copy the user-controlled ue->u.msi.data into e->msi.data without any validation:

    e->msi.data = ue->u.msi.data;

During MSI injection, kvm_set_msi() passes this value down to pch_msi_set_irq(), which directly uses it as the irq parameter:

    eiointc_set_irq(kvm->arch.eiointc, e->msi.data, level);

Inside eiointc_set_irq(), this untrusted value is used as an index in bitwise operations against s->isr and passed to eiointc_update_irq():

    level ? __set_bit(irq, isr) : __clear_bit(irq, isr);
    ...
    cpu = s->sw_coremap[irq];

Could this allow a malicious guest or unprivileged host userspace to perform an out-of-bounds memory read and write against the eiointc allocation?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Huacai Chen

maintainer Applied

2026-06-07 04:41 UTC #3 lore raw

Re: [v2 1/2] KVM: LoongArch: Validate irqchip index in irqfd routing

In reply to Yanfei Xu

Applied, thanks.

Huacai

Quoted 31 lines · Yanfei Xu

Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array.
Fixes 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Reported-by Sashiko <[email protected]>
Closes https://lore.kernel.org/kvm/[email protected]/ open here
Reviewed-by Bibo Mao <[email protected]>
Signed-off-by Yanfei Xu <[email protected]>
---
 arch/loongarch/kvm/irqfd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
arch/loongarch/kvm/irqfd.c +2 -2
index f4f953b22419..40ed1081c4b6 100644
@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
                e->irqchip.irqchip = ue->u.irqchip.irqchip;
                e->irqchip.pin = ue->u.irqchip.pin;
 
-               if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+               if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+                   e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
                        return -EINVAL;
 
                return 0;
--
2.20.1

Yanfei Xu

author

2026-05-31 13:55 UTC #4 lore raw

PATCH v2 2/2 KVM: PPC: Validate irqchip index in MPIC routing

In reply to Yanfei Xu

Sashiko reported that the irqchip index is not validated for PowerPC. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array.

Fixes de9ba2f36368 ("KVM: PPC: Support irq routing and irqfd for in-kernel MPIC")

Reported-by Sashiko <[email protected]>

Closes https://lore.kernel.org/kvm/[email protected]/ open here

Reviewed-by Harsh Prateek Bora <[email protected]>

Signed-off-by Yanfei Xu <[email protected]>

---
 arch/powerpc/kvm/mpic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/powerpc/kvm/mpic.c +2 -1

index 3070f36d9fb8..fb5f9e65e02e 100644
@@ -1833,7 +1833,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
 		e->set = mpic_set_irq;
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin;
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
 			goto out;
 		break;
 	case KVM_IRQ_ROUTING_MSI:

Signature · 1 line

2.20.1

Greg KH

maintainer

2026-05-31 14:15 UTC #5 lore raw

In reply to Yanfei Xu

Quoted 7 lines · Yanfei Xu

Validate irqchip indexes for LoongArch and PowerPC irq routing entries to reject out-of-range values before indexing the irqchip array.
v1->v2:
- Split the patch into two by architecture (Sean)
- Pick up Reviewed-by

Quoted 11 lines

Yanfei Xu (2):
KVM: LoongArch: Validate irqchip index in irqfd routing
KVM: PPC: Validate irqchip index in MPIC routing
 arch/loongarch/kvm/irqfd.c | 3 ++-
 arch/powerpc/kvm/mpic.c    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)
Signature · 1 line
2.20.1

This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

Yanfei Xu

2026-05-31 14:36 UTC #6 lore raw

Quoted 11 lines · Greg KH

Quoted 3 lines
Signature · 1 line
2.20.1
<formletter>
This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>

Thanks for pointing out the correct process. I saw that PPC maintainer added "Cc: [email protected]" on v1, so I mistakenly thought v2 should cc...

Thanks,
Yanfei

Greg KH

maintainer

2026-05-31 15:26 UTC #7 lore raw

Quoted 12 lines · Yanfei Xu

Quoted 10 lines · Greg KH
Quoted 3 lines
Signature · 1 line
2.20.1
<formletter>
This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

Quoted 5 lines

Quoted 1 line
</formletter>
Thanks for pointing out the correct process. I saw that PPC maintainer added "Cc: [email protected]" on v1, so I mistakenly thought v2 should cc...

That's great, then take a look at the file above to show you how to do that :)

Madhavan Srinivasan

maintainer Applied

2026-08-06 04:17 UTC #8 lore raw

Re: (subset) [v2 0/2] KVM: Validate irqchip index in routing entries

In reply to Yanfei Xu

Quoted 8 lines · Yanfei Xu

Validate irqchip indexes for LoongArch and PowerPC irq routing entries to reject out-of-range values before indexing the irqchip array.
v1->v2:
- Split the patch into two by architecture (Sean)
- Pick up Reviewed-by
[...]

Applied to powerpc/next.

[2/2] KVM: PPC: Validate irqchip index in MPIC routing

      https://git.kernel.org/powerpc/c/5458b50b5291390ce0af2872a1baa51cc58e8f08

cheers