From patchwork Fri Feb 27 13:46:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= X-Patchwork-Id: 2202294 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=JT8PYQy7; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=XR3vXfwI; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=QXOESULU; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4fMqTy17qCz1xy2 for ; Sat, 28 Feb 2026 00:50:46 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=2OSJuasavyBlLEIq5wHm/0OgLyI4XhT5ToWpLd7PJww=; b=JT8PYQy7FsuKyZ rHl0z8Xcfjc8Chi+lac05RL8GmBWKmDiL7QKmiuJMpl7DfU+FCo8Wd+rcDZAQhfqXB1v5SkV5DCr3 u8cAHe17u1IL1YUHiPctO1csYIvIz11DiPegMCcZMlAJSVkbAI79BTbISnvFEoy9Q7l85FKq8Lxxj AH8wiSbUxzsnjyrOgPcY7jxQcudoPhTJRQ3eLfItXZL3V1bEZKQILDv/5HEnlbnam60I5y8NgxTgo 1Q+rOLsbs7uL+gm5y9d/lcjjDoOsKkRW1DU0A6WxUb+3j0lgnaaKLMdj7q5FsWbmQUpNaXvx2UnSq kQQus7fRXvhRG4rPDpqQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vvyEu-00000008P9R-2Bt7; Fri, 27 Feb 2026 13:50:44 +0000 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vvyEr-00000008P8b-0FjR for kvm-riscv@lists.infradead.org; Fri, 27 Feb 2026 13:50:42 +0000 Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61RAJHkU1873165 for ; Fri, 27 Feb 2026 13:50:40 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=UCqPGnCmWVQCsvHc/I8KF7 mIauDPj2v0RjbE6kW19F0=; b=XR3vXfwIypu+k3TAlyzhOMwyBXzSoy3roAsh08 jyjRjY0elVLYz5y8pD+WyB/LhJLYpXfDYRT9NEqFEj3UpgeZoLFP1MSsPx/D0OD0 mZqZupUhNcV1IhlGRYWgmVoq0yq3IcSeA9jwIw7/7CBhQlqvTZ7HYjcfkXl4dpop /x5aD+b/GfUt9DVbz8AIXlSEPC+z+wnNkoCBhxoWnNHsDuS3cfYYT3nLRdxb6fgU MOjGevHIjTCdJ2MYtCrmw24aZrbPk4GpryBFDNSVcIxEK3Q0s6IhEP9HCndZOUAh nHWVZXarrQP5qyGOBFTOrCOh6Vy6P/UFD6T7Rt1BN7nCFFRg== Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cjuytu5xc-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 27 Feb 2026 13:50:39 +0000 (GMT) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-8c70fadd9a3so1927286485a.0 for ; Fri, 27 Feb 2026 05:50:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1772200239; x=1772805039; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=UCqPGnCmWVQCsvHc/I8KF7mIauDPj2v0RjbE6kW19F0=; b=QXOESULU2jZsVVwQH/B3uN1DKedHVgQdkorsdZ9elavUhm8fly76rFW2a/A45Bk/rT WCjc3lBljzpJvZFSK0nzzI4K21zd2aEaZ4MOhTEnjUNZ6WE/NmGve5hsnhkiO+TOeHvh RrxlV9f63A/gboTrPqfqzyp/l99r1n9AWopBSgXSBv0fKR1/mv7BgRmKngN3jWQLuqmb 2cUU1ydJWNRGhvZyMUeGGVSpbCeAggp0s0tiYyCSh3HHHNjXTogoWrIuVWJh+1MaPlr4 WxGVFtttSRSn+6nnoqJi7xAS21yJP6kuW7ej+6LJUboTQ46D9Ul7m+tiYdfyMaZrtVip cT1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772200239; x=1772805039; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=UCqPGnCmWVQCsvHc/I8KF7mIauDPj2v0RjbE6kW19F0=; b=Y4PxBMy1faxflVKowPfOwNoWHhyi4wi0Nk9sZnhfjvJxpnlDfegyNM78pkYh8nyBt5 +dASifloXNqXj1cnprYZ//X5ps4cabfw131NP9ZK9kseLFcZeQrnxIRCDlr97+1GXMOx bpjD8DB3Is6ronRm0utbvW0Cez6A8Zm5tMzVD9RJXPSDD2CasrB/4AVUXYIRihzZU0lt V7jLUyHYWz4ce+blfb/D72RdOBMuxx6e//p2wUBdUFN3awKxSA+pTzeS5FcDRlmZjrPv Tlzi630TgNyPguxui6WhL6Xm9RHsS4z0waF4oZQce92y4s4zG4cgZH9lYZChIgD1nC1+ GBtw== X-Gm-Message-State: AOJu0YzxC0MQmQnMpGORrDdLMPluO5iMsv0BpxXyfCQB1LOOUAx4DhIs 7y2xxF9JD3IEoz8h4zcTLjKhsXxtYzfkEVHifJBrfsTrYVyREytXfGr27v8xWUXi2G8X+OjefYr /OWm4ADsY7rB8GMsBKbirsM0fE0aqdTF9Fty+kjAxlz+WE5PLWU8kMmp4+AjZswZrpRaGNRVd1K Ov X-Gm-Gg: ATEYQzzmAkiWu8qbLV4urgj9KD0dIelua+rSgBhi1PJkCoAfGc9az8E9UqAzcRpohWH A6HnxsaIxorGU6tAymlkA9NtOWj9lWVsJWTHLCZhp9KEN3AZxN36zPkGKwHr1CtBZmqgosnVMl+ tiNKdqlVcckFWw+O+8qUES1A2q/m1K9OJCwDNq2/1tqpGA3WlkLXfmYccdq5upKzgDAxXKF0pcW GV4YlZFKt1H1mtGxwFIH36Qo0Od4BG1989PnDT+JJetzZJQvNnZqAFkyUcyqv2JPOdKAoFe3Wsb vB0VpimVuPFjo8hogCLIMfG7zpuiCXTrLgylJSK1SWNO+8lxgVImFg/i1ApfYs++1cmivgSuQg8 LEP22ihq9jcEGWsbGK18EhM023lZluoFBAOF7RQdBy5QOTDe5oPioQ3i2KQbG X-Received: by 2002:a05:620a:28c2:b0:8c8:8126:7770 with SMTP id af79cd13be357-8cbc8e7b3e4mr334774585a.67.1772200238897; Fri, 27 Feb 2026 05:50:38 -0800 (PST) X-Received: by 2002:a05:620a:28c2:b0:8c8:8126:7770 with SMTP id af79cd13be357-8cbc8e7b3e4mr334771285a.67.1772200238459; Fri, 27 Feb 2026 05:50:38 -0800 (PST) Received: from localhost (ip-86-49-242-13.bb.vodafone.cz. [86.49.242.13]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b935aec7091sm149414866b.58.2026.02.27.05.50.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 27 Feb 2026 05:50:37 -0800 (PST) From: =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= To: kvm-riscv@lists.infradead.org Cc: Lukas Gerlach , Anup Patel , Atish Patra , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Andrew Jones , kvm@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] RISC-V: KVM: fix off-by-one array access in SBI PMU Date: Fri, 27 Feb 2026 13:46:16 +0000 Message-ID: <20260227134617.23378-1-radim.krcmar@oss.qualcomm.com> X-Mailer: git-send-email 2.51.2 MIME-Version: 1.0 X-Authority-Analysis: v=2.4 cv=bJIb4f+Z c=1 sm=1 tr=0 ts=69a1a130 cx=c_pps a=HLyN3IcIa5EE8TELMZ618Q==:117 a=9tUHzIdeCh+UoOnba06Qjw==:17 a=IkcTkHD0fZMA:10 a=HzLeVaNsDn8A:10 a=M51BFTxLslgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=9SFidOni61YWn9SpgYUA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=zZCYzV9kfG8A:10 a=bTQJ7kPSJx9SKPbeHEYW:22 X-Proofpoint-ORIG-GUID: E3ogK_tWHRqWv8RFGEAkifuy5isTkgvc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjI3MDEyMyBTYWx0ZWRfX8kkjqB8xHzwb SuO5dunJKhJfcvlsCH3lhqFTqanV7gAU8HwozfGtNwBpHFe0w0wl3NgEewdYyGLV/r/0zoVR/3m 1ld6CRtn/ofTmuK+nEzI6Yf/qM/j1+x3p6uwy3bKDmCfFb4WogDj79Uj3Ksit6fJ5j1v+QBKM/w lQytRUjrlYY4O6Srp1gAGpGa4gGQkNw1JLJ/f9+1Gwit/AHc8MD9Lkd1jH7fIchBVBIDEYZHs5o Nj01gb1D0VFW4xs9bgSKxYFsyfVapKYExIlh/MtKyHFZgf7WveD3gjXABN2etz2mjauCvbwl3bC VGk7+ocXQl8ixMY+nHJip0sWr7ysIhNlCt7IabJg43Gjn6huwrMatZA3GlW0/haCZbOynRfBAIE hPQFHozl7FYIKwRv8V0gmurRLFGKtlpzFTtnFPHujxyG4OvdFN9TRwXIqr8cvB+cm8PtavHP1VC H2qWpQtJFRljTnqW8Fg== X-Proofpoint-GUID: E3ogK_tWHRqWv8RFGEAkifuy5isTkgvc X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-27_02,2026-02-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 bulkscore=0 adultscore=0 phishscore=0 suspectscore=0 impostorscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2602270123 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260227_055041_215023_CD17CDD6 X-CRM114-Status: GOOD ( 15.13 ) X-Spam-Score: -0.7 (/) X-Spam-Report: =?unknown-8bit?q?Spam_detection_software=2C_running_on_the_sy?= =?unknown-8bit?q?stem_=22bombadil=2Einfradead=2Eorg=22=2C?= =?unknown-8bit?q?_has_NOT_identified_this_incoming_email_as_spam=2E__The_ori?= =?unknown-8bit?q?ginal?= =?unknown-8bit?q?_message_has_been_attached_to_this_so_you_can_view_it_or_la?= =?unknown-8bit?q?bel?= =?unknown-8bit?q?_similar_future_email=2E__If_you_have_any_questions=2C_see?= =?unknown-8bit?q?_the_administrator_of_that_system_for_details=2E?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_preview=3A__The_indexed_array_only_has_RISCV=5FKVM?= =?unknown-8bit?q?=5FMAX=5FCOUNTERS_elements=2E?= =?unknown-8bit?q?_The_out-of-bound_access_could_have_been_performed_by_a_gue?= =?unknown-8bit?q?st=2C_but_it_could?= =?unknown-8bit?q?_only_access_another_guest_accessible_data=2E_Fixes=3A_8f01?= =?unknown-8bit?q?53ecd3bf_=28=22RISC-V=3A?= =?unknown-8bit?q?_KVM=3A_Add_skeleton_support_for_perf=22=29_Signed-off-by?= =?unknown-8bit?q?=3A_Radim_Kr=C4=8Dm=C3=A1=C5=99_=3Cradim=2Ekrcmar=40oss=2E?= =?unknown-8bit?q?qualcomm=2Ecom=3E?= =?unknown-8bit?q?_---_arch/riscv/kvm/vcpu=5Fpmu=2Ec_=7C_2_+-_1_file_changed?= =?unknown-8bit?q?=2C_1_insertion=28+=29=2C_1_=5B=2E=2E=2E=5D?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_analysis_details=3A___=28-0=2E7_points=2C_5=2E0_re?= =?unknown-8bit?q?quired=29?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_pts_rule_name______________description?= =?unknown-8bit?q?_----_----------------------_------------------------------?= =?unknown-8bit?q?--------------------?= =?unknown-8bit?q?_-0=2E7_RCVD=5FIN=5FDNSWL=5FLOW______RBL=3A_Sender_listed_a?= =?unknown-8bit?q?t_https=3A//www=2Ednswl=2Eorg/=2C_low?= =?unknown-8bit?q?_trust?= =?unknown-8bit?q?_=5B205=2E220=2E180=2E131_listed_in_list=2Ednswl=2Eorg=5D?= =?unknown-8bit?q?_0=2E0_SPF=5FHELO=5FNONE__________SPF=3A_HELO_does_not_publ?= =?unknown-8bit?q?ish_an_SPF_Record?= =?unknown-8bit?q?_-0=2E0_SPF=5FPASS_______________SPF=3A_sender_matches_SPF_?= =?unknown-8bit?q?record?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID=5FAU__________Message_has_a_valid_DKIM?= =?unknown-8bit?q?_or_DK_signature_from_author=27s?= =?unknown-8bit?q?_domain?= =?unknown-8bit?q?_0=2E1_DKIM=5FSIGNED____________Message_has_a_DKIM_or_DK_si?= =?unknown-8bit?q?gnature=2C_not_necessarily_valid?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID_____________Message_has_at_least_one_v?= =?unknown-8bit?q?alid_DKIM_or_DK_signature?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID=5FEF__________Message_has_a_valid_DKIM?= =?unknown-8bit?q?_or_DK_signature_from?= =?unknown-8bit?q?_envelope-from_domain?= =?unknown-8bit?q?_-1=2E9_BAYES=5F00_______________BODY=3A_Bayes_spam_probabi?= =?unknown-8bit?q?lity_is_0_to_1=25?= =?unknown-8bit?q?_=5Bscore=3A_0=2E0000=5D?= =?unknown-8bit?q?_0=2E7_RCVD=5FIN=5FVALIDITY=5FCERTIFIED=5FBLOCKED_RBL=3A_AD?= =?unknown-8bit?q?MINISTRATOR_NOTICE=3A_The?= =?unknown-8bit?q?_query_to_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B205=2E220=2E180=2E131_listed_in_sa-trusted=2Ebondedsend?= =?unknown-8bit?q?er=2Eorg=5D?= =?unknown-8bit?q?_1=2E0_RCVD=5FIN=5FVALIDITY=5FSAFE=5FBLOCKED_RBL=3A_ADMINIS?= =?unknown-8bit?q?TRATOR_NOTICE=3A_The_query_to?= =?unknown-8bit?q?_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B205=2E220=2E180=2E131_listed_in_sa-accredit=2Ehabeas=2E?= =?unknown-8bit?q?com=5D?= =?unknown-8bit?q?_0=2E4_RCVD=5FIN=5FVALIDITY=5FRPBL=5FBLOCKED_RBL=3A_ADMINIS?= =?unknown-8bit?q?TRATOR_NOTICE=3A_The_query_to?= =?unknown-8bit?q?_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B205=2E220=2E180=2E131_listed_in_bl=2Escore=2Esenderscor?= =?unknown-8bit?q?e=2Ecom=5D?= X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The indexed array only has RISCV_KVM_MAX_COUNTERS elements. The out-of-bound access could have been performed by a guest, but it could only access another guest accessible data. Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf") Signed-off-by: Radim Krčmář Reviewed-by: Anup Patel --- arch/riscv/kvm/vcpu_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index 4d8d5e9aa53d..aec6b293968b 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx, { struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu); - if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) { + if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) { retdata->err_val = SBI_ERR_INVALID_PARAM; return 0; }