[PATCH 1/2] RISC-V: KVM: Fix array out-of-bounds in pmu_ctr_read()

[Jiakai Xu]

When a guest invokes SBI_EXT_PMU_COUNTER_FW_READ on a firmware counter
that has not been configured via SBI_EXT_PMU_COUNTER_CFG_MATCH, the
pmc->event_idx remains SBI_PMU_EVENT_IDX_INVALID (0xFFFFFFFF).
get_event_code() extracts the lower 16 bits, yielding 0xFFFF (65535),
which is then used to index into kvpmu->fw_event[]. Since fw_event is
only RISCV_KVM_MAX_FW_CTRS (32) entries, this triggers an
array-index-out-of-bounds:

  UBSAN: array-index-out-of-bounds in arch/riscv/kvm/vcpu_pmu.c:255:37
  index 65535 is out of range for type 'kvm_fw_event [32]'

Add a bounds check on fevent_code before accessing the fw_event array,
returning -EINVAL for invalid event codes.

Fixes: badc386869e2c ("RISC-V: KVM: Support firmware events")
Signed-off-by: Jiakai Xu <xujiakai2025@xxxxxxxxxxx>
Signed-off-by: Jiakai Xu <jiakaiPeanut@xxxxxxxxx>
---
 arch/riscv/kvm/vcpu_pmu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index e873430e596b..c6d42459c2a1 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -252,6 +252,10 @@ static int pmu_ctr_read(struct kvm_vcpu *vcpu, unsigned long cidx,
 
 	if (pmc->cinfo.type == SBI_PMU_CTR_TYPE_FW) {
 		fevent_code = get_event_code(pmc->event_idx);
+		if (fevent_code >= SBI_PMU_FW_MAX) {
+			pr_warn("Invalid firmware event code [%d] for counter [%ld]\n", fevent_code, cidx);
+			return -EINVAL;
+		}
 		pmc->counter_val = kvpmu->fw_event[fevent_code].value;
 	} else if (pmc->perf_event) {
 		pmc->counter_val += perf_event_read_value(pmc->perf_event, &enabled, &running);
-- 
2.34.1