[PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

Subsystems: kernel virtual machine for loongarch (kvm/loongarch), kernel virtual machine for powerpc (kvm/powerpc), linux for powerpc (32-bit and 64-bit), loongarch, the rest

STALE127d

5 messages, 5 authors, 2026-05-31 · open the first message on its own page

[PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

From: Yanfei Xu <hidden>
Date: 2026-05-25 07:02:20

Sashiko reported that irqchip index is not validated for LoongArch and
PowerPC. Add validation and reject out-of-range irqchip indexes to avoid
indexing past the routing table's chip array.

Fixes: de9ba2f36368 ("KVM: PPC: Support irq routing and irqfd for in-kernel MPIC")
Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/
Signed-off-by: Yanfei Xu <redacted>
---
 arch/loongarch/kvm/irqfd.c | 3 ++-
 arch/powerpc/kvm/mpic.c    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kvm/irqfd.c b/arch/loongarch/kvm/irqfd.c
index f4f953b22419..40ed1081c4b6 100644
--- a/arch/loongarch/kvm/irqfd.c
+++ b/arch/loongarch/kvm/irqfd.c

@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin;
 
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
 			return -EINVAL;
 
 		return 0;

diff --git a/arch/powerpc/kvm/mpic.c b/arch/powerpc/kvm/mpic.c
index 3070f36d9fb8..fb5f9e65e02e 100644
--- a/arch/powerpc/kvm/mpic.c
+++ b/arch/powerpc/kvm/mpic.c

@@ -1833,7 +1833,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
 		e->set = mpic_set_irq;
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin;
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
 			goto out;
 		break;
 	case KVM_IRQ_ROUTING_MSI:

-- 
2.20.1

Re: [PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

From: Harsh Prateek Bora <hidden>
Date: 2026-05-26 06:33:41

+ cc: stable@vger.kernel.org

On 25/05/26 12:31 pm, Yanfei Xu wrote:

quoted hunk

Sashiko reported that irqchip index is not validated for LoongArch and
PowerPC. Add validation and reject out-of-range irqchip indexes to avoid
indexing past the routing table's chip array.

Fixes: de9ba2f36368 ("KVM: PPC: Support irq routing and irqfd for in-kernel MPIC")
Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/
Signed-off-by: Yanfei Xu <redacted>
---
  arch/loongarch/kvm/irqfd.c | 3 ++-
  arch/powerpc/kvm/mpic.c    | 3 ++-
  2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kvm/irqfd.c b/arch/loongarch/kvm/irqfd.c
index f4f953b22419..40ed1081c4b6 100644
--- a/arch/loongarch/kvm/irqfd.c
+++ b/arch/loongarch/kvm/irqfd.c

@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
  		e->irqchip.pin = ue->u.irqchip.pin;
  
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
  			return -EINVAL;
  
  		return 0;

diff --git a/arch/powerpc/kvm/mpic.c b/arch/powerpc/kvm/mpic.c
index 3070f36d9fb8..fb5f9e65e02e 100644
--- a/arch/powerpc/kvm/mpic.c
+++ b/arch/powerpc/kvm/mpic.c

@@ -1833,7 +1833,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
  		e->set = mpic_set_irq;
  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
  		e->irqchip.pin = ue->u.irqchip.pin;
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)

Reviewed-by: Harsh Prateek Bora <redacted> # PPC KVM

  			goto out;
  		break;
  	case KVM_IRQ_ROUTING_MSI:

Re: [PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

From: Bibo Mao <maobibo@loongson.cn>
Date: 2026-05-26 07:07:15


On 2026/5/25 下午3:01, Yanfei Xu wrote:

quoted hunk

Sashiko reported that irqchip index is not validated for LoongArch and
PowerPC. Add validation and reject out-of-range irqchip indexes to avoid
indexing past the routing table's chip array.

Fixes: de9ba2f36368 ("KVM: PPC: Support irq routing and irqfd for in-kernel MPIC")
Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/
Signed-off-by: Yanfei Xu <redacted>
---
  arch/loongarch/kvm/irqfd.c | 3 ++-
  arch/powerpc/kvm/mpic.c    | 3 ++-
  2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kvm/irqfd.c b/arch/loongarch/kvm/irqfd.c
index f4f953b22419..40ed1081c4b6 100644
--- a/arch/loongarch/kvm/irqfd.c
+++ b/arch/loongarch/kvm/irqfd.c

@@ -51,7 +51,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
  		e->irqchip.pin = ue->u.irqchip.pin;
  
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
  			return -EINVAL;
  
  		return 0;

diff --git a/arch/powerpc/kvm/mpic.c b/arch/powerpc/kvm/mpic.c
index 3070f36d9fb8..fb5f9e65e02e 100644
--- a/arch/powerpc/kvm/mpic.c
+++ b/arch/powerpc/kvm/mpic.c

@@ -1833,7 +1833,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
  		e->set = mpic_set_irq;
  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
  		e->irqchip.pin = ue->u.irqchip.pin;
-		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
+		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
+		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
  			goto out;
  		break;
  	case KVM_IRQ_ROUTING_MSI:

Hi Yanfei,

That is important fixes, thanking for your efforts.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>

Re: [PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

From: Sean Christopherson <seanjc@google.com>
Date: 2026-05-29 22:51:36

On Mon, May 25, 2026, Yanfei Xu wrote:

Sashiko reported that irqchip index is not validated for LoongArch and
PowerPC. Add validation and reject out-of-range irqchip indexes to avoid
indexing past the routing table's chip array.

Can you split this into two patches, and send a v2?  I suspect the reason no one
has picked this up is because it straddles two completely different (sub)subsystems.

That would also make it easier to get the fixes backported to stable trees.  PPC
has been around a lot longer than LoongArch, so I assume the PPC fix will need to
go further back in time.

Thanks!

Re: [PATCH] KVM: Validate irqchip index for LoongArch and PowerPC

From: Yanfei Xu <hidden>
Date: 2026-05-31 14:02:26

On 2026/5/30 06:51, Sean Christopherson wrote:

Can you split this into two patches, and send a v2?  I suspect the reason no one
has picked this up is because it straddles two completely different (sub)subsystems.

That makes sense. Done :)

Thanks,
Yanfei

That would also make it easier to get the fixes backported to stable trees.  PPC
has been around a lot longer than LoongArch, so I assume the PPC fix will need to
go further back in time.

Thanks!

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help