imsic_init() indexes msi[] by the Xen CPU id hartid_to_cpuid() returns,
but that array is allocated with one entry per parent IRQ of the IMSIC
node, and the only range check compares the index against
num_possible_cpus(). Neither matches the array, and the check comes
after the first access:

- hartid_to_cpuid() returns NR_CPUS when the hart isn't one Xen brought
  up, and msi[NR_CPUS].base_addr is read before that is noticed;
- an IMSIC node listing fewer parents than Xen has CPUs makes every
  index past nr_parent_irqs go past the end of the allocation, which the
  num_possible_cpus() check lets through.

Size the array by nr_cpu_ids, which is what it is indexed by,
and move the range check ahead of the first msi[] access.

Fixes: c9bd8b322ecb ("xen/riscv: imsic_init() implementation")
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v3:
 - Drop local variable nr_msis and use nr_cpu_ids explicitly.
---
Changes in v2:
 - Use nr_cpu_ids instead of num_possible_cpus() to not be dependent on
   if cpu_possible_map is sparsed or not.
---
---
 xen/arch/riscv/imsic.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/xen/arch/riscv/imsic.c b/xen/arch/riscv/imsic.c
index f7b70a8da09e..8da72c007225 100644
--- a/xen/arch/riscv/imsic.c
+++ b/xen/arch/riscv/imsic.c
@@ -346,7 +346,7 @@ int __init imsic_init(const struct dt_device_node *node)
         goto imsic_init_err;
     }
 
-    msi = xvzalloc_array(struct imsic_msi, nr_parent_irqs);
+    msi = xvzalloc_array(struct imsic_msi, nr_cpu_ids);
     if ( !msi )
     {
         rc = -ENOMEM;
@@ -405,7 +405,18 @@ int __init imsic_init(const struct dt_device_node *node)
             continue;
         }
 
+        /*
+         * hartid_to_cpuid() returns NR_CPUS for a hart Xen doesn't know, so
+         * the range has to be checked before msi[] is indexed at all.
+         */
         cpu = hartid_to_cpuid(hartid);
+        if ( cpu >= nr_cpu_ids )
+        {
+            printk(XENLOG_WARNING
+                   "%s: unsupported hart ID=%#lx for parent irq%u\n",
+                   node->name, hartid, i);
+            continue;
+        }
 
         /*
          * If .base_addr is not 0, it indicates that the CPU has already been
@@ -421,13 +432,6 @@ int __init imsic_init(const struct dt_device_node *node)
             continue;
         }
 
-        if ( cpu >= num_possible_cpus() )
-        {
-            printk(XENLOG_WARNING "%s: unsupported hart ID=%#lx for parent irq%u\n",
-                   node->name, hartid, i);
-            continue;
-        }
-
         /* Find MMIO location of MSI page */
         reloff = i * IMSIC_HART_SIZE(imsic_cfg.guest_index_bits);
         for ( index = 0; index < nr_mmios; index++ )
-- 
2.55.0

On 03.09.2026 17:05, Oleksii Kurochko wrote:
> imsic_init() indexes msi[] by the Xen CPU id hartid_to_cpuid() returns,
> but that array is allocated with one entry per parent IRQ of the IMSIC
> node, and the only range check compares the index against
> num_possible_cpus(). Neither matches the array, and the check comes
> after the first access:
> 
> - hartid_to_cpuid() returns NR_CPUS when the hart isn't one Xen brought
>   up, and msi[NR_CPUS].base_addr is read before that is noticed;
> - an IMSIC node listing fewer parents than Xen has CPUs makes every
>   index past nr_parent_irqs go past the end of the allocation, which the
>   num_possible_cpus() check lets through.
> 
> Size the array by nr_cpu_ids, which is what it is indexed by,
> and move the range check ahead of the first msi[] access.
> 
> Fixes: c9bd8b322ecb ("xen/riscv: imsic_init() implementation")
> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>