Re: [PATCH 1/2] LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

[Huacai Chen]

On Mon, Mar 23, 2026 at 3:59 PM Bibo Mao <maobibo@xxxxxxxxxxx> wrote:
>
>
>
> On 2026/3/23 下午3:08, Huacai Chen wrote:
> > On Mon, Mar 23, 2026 at 11:16 AM Bibo Mao <maobibo@xxxxxxxxxxx> wrote:
> >>
> >>
> >>
> >> On 2026/3/22 下午9:53, Huacai Chen wrote:
> >>> kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so
> >>> cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this
> >>> case so as to make it more robust.
> >>>
> >>> This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].
> >>>
> >>> Cc: <stable@xxxxxxxxxxxxxxx>
> >>> Fixes: 73516e9da512adc ("LoongArch: KVM: Add vcpu mapping from physical cpuid")
> >>> Reported-by: Aurelien Jarno <aurel32@xxxxxxxxxx>
> >>> Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
> >>> Signed-off-by: Huacai Chen <chenhuacai@xxxxxxxxxxx>
> >>> ---
> >>>    arch/loongarch/kvm/vcpu.c | 3 +++
> >>>    1 file changed, 3 insertions(+)
> >>>
> >>> diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
> >>> index 8ffd50a470e6..831f381a8fd1 100644
> >>> --- a/arch/loongarch/kvm/vcpu.c
> >>> +++ b/arch/loongarch/kvm/vcpu.c
> >>> @@ -588,6 +588,9 @@ struct kvm_vcpu *kvm_get_vcpu_by_cpuid(struct kvm *kvm, int cpuid)
> >>>    {
> >>>        struct kvm_phyid_map *map;
> >>>
> >>> +     if (cpuid < 0)
> >>> +             return NULL;
> >>> +
> >>>        if (cpuid >= KVM_MAX_PHYID)
> >>>                return NULL;
> >>>
> >>>
> >>
> >> if (cpuid < 0 || cpuid >= KVM_MAX_PHYID)?
> >> however both are OK for me.
> > I use a similar style as kvm_get_vcpu_by_id(). :)
> >
> > But there is another warning which can't be solved by this series (and
> > I doubt whether it can be solved unless revert 01a8e68396a6d51f5b).
> > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
>
> what is the kernel config file with bug
>     https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
I don't know exactly, but it needs CONFIG_FORTIFY_SOURCE.

Huacai

>
> kvm_eiointc_regs_access() seems has problem, it need convert to void *
> before arithmetic operation. I do not know whether this patch can solve
> this bug.
>
> diff --git a/arch/loongarch/kvm/intc/eiointc.c
> b/arch/loongarch/kvm/intc/eiointc.c
> index d2acb4d09e73..71bd67b57338 100644
> --- a/arch/loongarch/kvm/intc/eiointc.c
> +++ b/arch/loongarch/kvm/intc/eiointc.c
> @@ -472,34 +472,34 @@ static int kvm_eiointc_regs_access(struct
> kvm_device *dev,
>          switch (addr) {
>          case EIOINTC_NODETYPE_START ... EIOINTC_NODETYPE_END:
>                  offset = (addr - EIOINTC_NODETYPE_START) / 4;
> -               p = s->nodetype + offset * 4;
> +               p = (void *)s->nodetype + offset * 4;
>                  break;
>          case EIOINTC_IPMAP_START ... EIOINTC_IPMAP_END:
>                  offset = (addr - EIOINTC_IPMAP_START) / 4;
> -               p = &s->ipmap + offset * 4;
> +               p = (void *)&s->ipmap + offset * 4;
>                  break;
>          case EIOINTC_ENABLE_START ... EIOINTC_ENABLE_END:
>                  offset = (addr - EIOINTC_ENABLE_START) / 4;
> -               p = s->enable + offset * 4;
> +               p = (void *)s->enable + offset * 4;
>                  break;
>          case EIOINTC_BOUNCE_START ... EIOINTC_BOUNCE_END:
>                  offset = (addr - EIOINTC_BOUNCE_START) / 4;
> -               p = s->bounce + offset * 4;
> +               p = (void *)s->bounce + offset * 4;
>                  break;
>          case EIOINTC_ISR_START ... EIOINTC_ISR_END:
>                  offset = (addr - EIOINTC_ISR_START) / 4;
> -               p = s->isr + offset * 4;
> +               p = (void *)s->isr + offset * 4;
>                  break;
>          case EIOINTC_COREISR_START ... EIOINTC_COREISR_END:
>                  if (cpu >= s->num_cpu)
>                          return -EINVAL;
>
>                  offset = (addr - EIOINTC_COREISR_START) / 4;
> -               p = s->coreisr[cpu] + offset * 4;
> +               p = (void *)s->coreisr[cpu] + offset * 4;
>                  break;
>          case EIOINTC_COREMAP_START ... EIOINTC_COREMAP_END:
>                  offset = (addr - EIOINTC_COREMAP_START) / 4;
> -               p = s->coremap + offset * 4;
> +               p = (void *)s->coremap + offset * 4;
>                  break;
>          default:
>                  kvm_err("%s: unknown eiointc register, addr = %d\n",
> __func__, addr);
>
>
> Regards
> Bibo Mao
> >
> > Huacai
> >
> >>
> >> Reviewed-by: Bibo Mao <maobibo@xxxxxxxxxxx>
> >>
>
>