[PATCH] RISC-V: KVM: Fix out-of-bounds index into aia_irq2bitpos[]

[Wang Yechao]

aia_get_iprio8() and aia_set_iprio8() index the 64-entry
aia_irq2bitpos[] array with an irq value derived from the
guest-controlled VSISELECT register. For RV64:

  first_irq = (isel - ISELECT_IPRIO0) * 4
  nirqs = 8
  isel up to ISELECT_IPRIO15

so the irq number can reach 67 and aia_irq2bitpos[64..67] is
accessed out of bounds. A malicious guest can trigger this,
causing host panic under KASAN/UBSAN or undefined behavior
otherwise.

Add an explicit bounds check in both accessors before indexing
the table.

Fixes: 2f4d58f7635a ("RISC-V: KVM: Virtualize per-HART AIA CSRs")
Signed-off-by: Wang Yechao <wang.yechao255@xxxxxxxxxx>
---
 arch/riscv/kvm/aia.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/aia.c b/arch/riscv/kvm/aia.c
index b3b466e4db33..a51d2db7f331 100644
--- a/arch/riscv/kvm/aia.c
+++ b/arch/riscv/kvm/aia.c
@@ -286,8 +286,12 @@ static int aia_irq2bitpos[] = {
 static u8 aia_get_iprio8(struct kvm_vcpu *vcpu, unsigned int irq)
 {
 	unsigned long hviprio;
-	int bitpos = aia_irq2bitpos[irq];
+	int bitpos;
 
+	if (irq >= ARRAY_SIZE(aia_irq2bitpos))
+		return 0;
+
+	bitpos = aia_irq2bitpos[irq];
 	if (bitpos < 0)
 		return 0;
 
@@ -319,8 +323,12 @@ static u8 aia_get_iprio8(struct kvm_vcpu *vcpu, unsigned int irq)
 static void aia_set_iprio8(struct kvm_vcpu *vcpu, unsigned int irq, u8 prio)
 {
 	unsigned long hviprio;
-	int bitpos = aia_irq2bitpos[irq];
+	int bitpos;
+
+	if (irq >= ARRAY_SIZE(aia_irq2bitpos))
+		return;
 
+	bitpos = aia_irq2bitpos[irq];
 	if (bitpos < 0)
 		return;
 
-- 
2.27.0