LoongArch: KVM: EIOINTC: fix INT_ENCODE ipnum out-of-bounds access

From: Tao Cui <[email protected]>

This small series fixes a guest-triggerable out-of-bounds access in the LoongArch KVM EIOINTC emulation, then factors the duplicated IP-number decode into a helper.

The IP-number decode in eiointc_set_sw_coreisr() and eiointc_update_irq() bounds ipnum only in the default (1-hot) mode. In INT_ENCODE mode the raw ipmap byte (0..255) is used to index sw_coreisr[cpu][ipnum], whose second dimension is LOONGSON_IP_NUM (8), so any ipmap byte >= 8 reads/writes past the array. The value is guest-programmable through the EIOINTC virtual extension (VIRT_CONFIG enables INT_ENCODE and the IPMAP IOCSR write is not validated) and is also restored from a migration stream via the LOAD_FINISHED control attribute, so this is a host slab out-of-bounds access reachable from an unprivileged guest.

Patch 1 is the minimal, stable-bound fix: clamp ipnum to [0, LOONGSON_IP_NUM) in INT_ENCODE mode at both call sites. Patch 2 is a follow-up cleanup that extracts the now-identical decode into eiointc_get_ipnum() (no functional change); it is split out so the fix stays surgical for backporting.

Verified with KASAN on Loongson-3A6000: the device-attr restore sequence (INT_ENCODE + ipmap byte 0x80 + LOAD_FINISHED) reports
"BUG: KASAN: slab-out-of-bounds in eiointc_set_sw_coreisr" without the series and is clean with it.

Patch 1 carries Fixes:/Cc: stable; patch 2 is mainline-only.

Tao Cui (2):
LoongArch: KVM: EIOINTC: clamp ipnum to valid range in INT_ENCODE mode
LoongArch: KVM: EIOINTC: factor IP-number decode into a helper

 arch/loongarch/kvm/intc/eiointc.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

--
2.43.0