From nobody Mon May 25 01:58:06 2026 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF49740960B for ; Tue, 19 May 2026 13:25:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779197136; cv=none; b=X+kTRVveWPaymhhFTtgrkPR1IjmUAsf8WQwLGmTcO1qW3yH5JyLsGjCIqyGcaVXI1ieXokJ4kIyHa7W1K8Xoe5wzQ2i3IIi96GP9OGqyud0An0HOGiYtzzBn+HNWXkFEYT3tVCmoZH4+zykZWf3FlUuUBobgjEIqvgb5V6H5fYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779197136; c=relaxed/simple; bh=MPMKDbaoJm8lYSmKNZ/S8Jqum0mwmrvQaQMqtJ3cNuo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QbV6zmJJvds0StksIlYIKrMm4P/MVrMMa60p9uSqm5wlSKShpdVAW8dJsmqZxDo5KbLMuVUxdfnuvHYlYlJ9I3MwL2oe3mvgVJbWBkmrua5LruYBIwZ4SgwaaZA3jK63dc+H5kuiXjEPP7M5Pza419Vv0WW8FT+Vo3rUuBmmFiE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dxnyka6V; arc=none smtp.client-ip=209.85.219.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dxnyka6V" Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-8b7dccd6fe4so35057026d6.1 for ; Tue, 19 May 2026 06:25:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779197134; x=1779801934; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=yFek1k0mWh/Ty3927Ox1UTfk318qie1Wk1ylGq+Jroc=; b=dxnyka6VblZw4qu4cCr27xI8DnEIBUZbIms490/zgEqcGyshmj3OkvA2Fd9QZFHwY5 xQfN+8QURMhS8d7MDJLiYu8lcBmSQaY+En+ADLY9UaZRu4KC0t48ubCRDgV6PGyXWBhp 0booCqEpiD6s0crUIV3dn6oThPX2C2rOTxe3BqJPA4c7TmkJ41wmtfv4XdCLuweOOizF 73PR1g6h1Havwh4pBP54xuFtIzCdoniUQ8oy5YjbRpZKraIjpsTUp7tA7YU+H3OeCy+k ewKtMv2nPc651vdY5ZkQ05CRZa4gwngUUu3GbrsZUlQnO4M+BgkXW0A3V+xMDjfCGcnG ChCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779197134; x=1779801934; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=yFek1k0mWh/Ty3927Ox1UTfk318qie1Wk1ylGq+Jroc=; b=VCbNBkf2h2Qx52Abi1iKlIJis78ByXK+ig9ZR3DRGR+PTKa8IBxiMDHiCc5MZiVxgV ULPMe5PprNYuh7DnAv9kl5jo8uwYF3g/C7oa9pivq42aXM+k1cGi3X3HTG0ezY4lUsrb x3moFVnFY8byLxfzdxBmI+6GJL0vaSUcw7BEcNgiJ9PaGFuP5P8+XLqyoMKkKKrVzAjp efnFHA6rXxJ/G06/LfJFJsW5RaeWtFjcSMtSSbBuEY8qrRo9QO77uoYalnEhtrQq+zkj 2fOA2mRzjV34rW3oS/rXwx8B1rGygP87TOM6ftjSkzQ3bLGLmUdpElzPAWayQgiNk3JS esTg== X-Forwarded-Encrypted: i=1; AFNElJ9vJqdLH549FkxEn+2pgI3+3SJzq55T0trUhJDbEGGjc1kxN45T7Fy8XUN2g0h5XYWG5tk5ebAsmCD0bQc=@vger.kernel.org X-Gm-Message-State: AOJu0Yy0Z1xEY5QW6IxceRp1l6L6E7w9y0bVchb55ize7vALeX0Sgf1Z JomckX77rQCGEsro4eVX1Uxn0mAXsWNgTqjsZFQP3nSb3TuJZBRE8+R+ X-Gm-Gg: Acq92OEL9/b0TYho5uBAMaltXqPC9U4VwHwG8/SWkI0rUhQ16he49l8lW93Rpu5vTml wmVQyUzXuqw0Op2McIsCDUYVmEmpRHHSYRoFOgPuNJ10up2mmZIDReOegVxGzXY2rFi5S/KvSQg DuMDbxb/x7V7nCHxXFGXIdnB0A/zwOp+MMXwINK92URaE00AA4HqOp6Gh97ZoTX9Mgyv6My7tMX lz1LoziZgRyqu1h0j9syMZQbEmoeZpT5A341xkpv/1NpMSboFF4V869+U+uPr5tobGpUPDUxWWb ylr8cqO+IIVucFD+oJcmlKv2C/CuztNozpJxIBrINjG+MIArN75YP9nnA+qg8VZl8PHkrm04pTV ZgiCARfV+c/5OjNHLyfXP/Rt8YgTyJTscEvd2dUftkBzjGvvtjjQ+Q6VNJmkDa/OWkKi2m3fhwS ov2vbT2K2LLwAcqIMLLvDYhSjNJ8j8qk1gcpBmdIRWbt780q/UEy95uS7EHC512ejUt6Qztka4w M7vjU3RmS34lPmcD1+RVCJGckkJwBU= X-Received: by 2002:a0c:f08f:0:b0:895:498e:e9dd with SMTP id 6a1803df08f44-8ca0f64306bmr262712696d6.2.1779197133608; Tue, 19 May 2026 06:25:33 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ca36097a26sm90563716d6.17.2026.05.19.06.25.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 06:25:33 -0700 (PDT) From: Michael Bommarito To: Marc Zyngier , Oliver Upton Cc: Yao Yuan , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH v2] KVM: arm64: vgic-its: reject restored DTE with out-of-range num_eventid_bits Date: Tue, 19 May 2026 09:25:19 -0400 Message-ID: <20260519132519.2142458-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260517174955.273004-1-michael.bommarito@gmail.com> References: <20260517174955.273004-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range. Fixes: 57a9a117154c ("KVM: arm64: vgic-its: Device table save/restore") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- Changes in v2: - Trim the commit message to the root cause and fix. - Shorten the in-code comment as suggested by Marc. - Keep the validation logic unchanged. arch/arm64/kvm/vgic/vgic-its.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 2ea9f1c7ebcd0..1d7e5d560af4c 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2307,6 +2307,10 @@ static int vgic_its_restore_dte(struct vgic_its *its= , u32 id, /* dte entry is valid */ offset =3D (entry & KVM_ITS_DTE_NEXT_MASK) >> KVM_ITS_DTE_NEXT_SHIFT; =20 + /* Mimic the MAPD behaviour and reject invalid EID bits. */ + if (num_eventid_bits > VITS_TYPER_IDBITS) + return -EINVAL; + if (!vgic_its_check_id(its, baser, id, NULL)) return -EINVAL; =20 --=20 2.53.0