Re: [PATCH 1/2] LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
From: Bibo Mao
Date: Mon Mar 23 2026 - 04:11:50 EST
On 2026/3/23 下午3:56, Bibo Mao wrote:
It is introduced by patch d3e43a1f34ac ("LoongArch: KVM: Use 64-bit register definition for EIOINTC").
On 2026/3/23 下午3:08, Huacai Chen wrote:
On Mon, Mar 23, 2026 at 11:16 AM Bibo Mao <maobibo@xxxxxxxxxxx> wrote:
I use a similar style as kvm_get_vcpu_by_id(). :)
On 2026/3/22 下午9:53, Huacai Chen wrote:
kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so
cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this
case so as to make it more robust.
This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].
Cc: <stable@xxxxxxxxxxxxxxx>
Fixes: 73516e9da512adc ("LoongArch: KVM: Add vcpu mapping from physical cpuid")
Reported-by: Aurelien Jarno <aurel32@xxxxxxxxxx>
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
Signed-off-by: Huacai Chen <chenhuacai@xxxxxxxxxxx>
---
arch/loongarch/kvm/vcpu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index 8ffd50a470e6..831f381a8fd1 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -588,6 +588,9 @@ struct kvm_vcpu *kvm_get_vcpu_by_cpuid(struct kvm *kvm, int cpuid)
{
struct kvm_phyid_map *map;
+ if (cpuid < 0)
+ return NULL;
+
if (cpuid >= KVM_MAX_PHYID)
return NULL;
if (cpuid < 0 || cpuid >= KVM_MAX_PHYID)?
however both are OK for me.
But there is another warning which can't be solved by this series (and
I doubt whether it can be solved unless revert 01a8e68396a6d51f5b).
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
what is the kernel config file with bug
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
kvm_eiointc_regs_access() seems has problem, it need convert to void * before arithmetic operation. I do not know whether this patch can solve this bug.
Regards
Bibo Mao
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index d2acb4d09e73..71bd67b57338 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -472,34 +472,34 @@ static int kvm_eiointc_regs_access(struct kvm_device *dev,
switch (addr) {
case EIOINTC_NODETYPE_START ... EIOINTC_NODETYPE_END:
offset = (addr - EIOINTC_NODETYPE_START) / 4;
- p = s->nodetype + offset * 4;
+ p = (void *)s->nodetype + offset * 4;
break;
case EIOINTC_IPMAP_START ... EIOINTC_IPMAP_END:
offset = (addr - EIOINTC_IPMAP_START) / 4;
- p = &s->ipmap + offset * 4;
+ p = (void *)&s->ipmap + offset * 4;
break;
case EIOINTC_ENABLE_START ... EIOINTC_ENABLE_END:
offset = (addr - EIOINTC_ENABLE_START) / 4;
- p = s->enable + offset * 4;
+ p = (void *)s->enable + offset * 4;
break;
case EIOINTC_BOUNCE_START ... EIOINTC_BOUNCE_END:
offset = (addr - EIOINTC_BOUNCE_START) / 4;
- p = s->bounce + offset * 4;
+ p = (void *)s->bounce + offset * 4;
break;
case EIOINTC_ISR_START ... EIOINTC_ISR_END:
offset = (addr - EIOINTC_ISR_START) / 4;
- p = s->isr + offset * 4;
+ p = (void *)s->isr + offset * 4;
break;
case EIOINTC_COREISR_START ... EIOINTC_COREISR_END:
if (cpu >= s->num_cpu)
return -EINVAL;
offset = (addr - EIOINTC_COREISR_START) / 4;
- p = s->coreisr[cpu] + offset * 4;
+ p = (void *)s->coreisr[cpu] + offset * 4;
break;
case EIOINTC_COREMAP_START ... EIOINTC_COREMAP_END:
offset = (addr - EIOINTC_COREMAP_START) / 4;
- p = s->coremap + offset * 4;
+ p = (void *)s->coremap + offset * 4;
break;
default:
kvm_err("%s: unknown eiointc register, addr = %d\n", __func__, addr);
Regards
Bibo Mao
Huacai
Reviewed-by: Bibo Mao <maobibo@xxxxxxxxxxx>