From patchwork Fri Mar 6 07:37:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiakai Xu X-Patchwork-Id: 2206030 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=ZZpIKgPG; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4fRytn3QzVz1xw1 for ; Fri, 06 Mar 2026 18:38:09 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=OM3c00YIWKf6hWZMGqDkhVwK7TotrEdzV6DLhIyoako=; b=ZZpIKgPGurdDzs IstblweckpQPba2t3526KelmAqiVTs8+YuN0zSxPMgghsZxN0+6/+bNhgaL5CFxu53mqfYPOSV/Sq NzcZazbcwMB4p4LlTxc+6RajCGdpoXp1xDarxr64pPpadvRDUhLcYoIYF4PZxruZ/gu/sq/ozkGok kpTI5P30F3bzMl4IKZS2Z1/9a5AfHgSwVMITsrSuhp2WIDohUM0opWF8q+fzael5nVHHY1IMLTPIw vkcYHcuq+QavHow+4MqpVrXFiRAT07xycGl4e71zvzsCBmVawW82dKZddl+OA/y8/ZAsaiYD5jtdh Aoo+WmmJ4FOX4eSSfYmw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vyPl9-00000003A2t-3Zgk; Fri, 06 Mar 2026 07:38:07 +0000 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vyPl2-000000039zC-0fH3; Fri, 06 Mar 2026 07:38:03 +0000 Received: from fric.. (unknown [210.73.43.101]) by APP-05 (Coremail) with SMTP id zQCowAAXpglFhKppgcC9CQ--.1822S3; Fri, 06 Mar 2026 15:37:43 +0800 (CST) From: Jiakai Xu To: linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, kvm-riscv@lists.infradead.org, kvm@vger.kernel.org Cc: Andrew Jones , Alexandre Ghiti , Albert Ou , Palmer Dabbelt , Paul Walmsley , Atish Patra , Anup Patel , Jiakai Xu , Jiakai Xu Subject: [PATCH 1/2] RISC-V: KVM: Fix array out-of-bounds in pmu_ctr_read() Date: Fri, 6 Mar 2026 07:37:38 +0000 Message-Id: <20260306073739.3441292-2-xujiakai2025@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260306073739.3441292-1-xujiakai2025@iscas.ac.cn> References: <20260306073739.3441292-1-xujiakai2025@iscas.ac.cn> MIME-Version: 1.0 X-CM-TRANSID: zQCowAAXpglFhKppgcC9CQ--.1822S3 X-Coremail-Antispam: 1UD129KBjvJXoW7Cw43uw45GF1xXw43Ar1fJFb_yoW8Ar15pr sFkr9a93s5trs29w1Yyw1Duw4jyw4kGan8CrWDGF18Ar4a9r97JF1v93srJr1fAFZFqa4x ta1Fka4xCFW5Xa7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQF14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2 x26xkF7I0E14v26r4j6ryUM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJw A2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAa c4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzV Aqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S 6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxw ACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxG rwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4 vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IY x2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04k26c xKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAF wI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUn18PUUUUU= X-Originating-IP: [210.73.43.101] X-CM-SenderInfo: 50xmxthndljiysv6x2xfdvhtffof0/1tbiBgwSCWmqYdd74wAAs8 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260305_233800_580543_AF8D0C7C X-CRM114-Status: UNSURE ( 8.96 ) X-CRM114-Notice: Please train this message. X-Spam-Score: 0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When a guest invokes SBI_EXT_PMU_COUNTER_FW_READ on a firmware counter that has not been configured via SBI_EXT_PMU_COUNTER_CFG_MATCH, the pmc->event_idx remains SBI_PMU_EVENT_IDX_INVALID (0xFFFFFFFF) [...] Content analysis details: (0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.6 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in sa-trusted.bondedsender.org] 0.6 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in sa-accredit.habeas.com] 0.9 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in bl.score.senderscore.com] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [159.226.251.25 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org When a guest invokes SBI_EXT_PMU_COUNTER_FW_READ on a firmware counter that has not been configured via SBI_EXT_PMU_COUNTER_CFG_MATCH, the pmc->event_idx remains SBI_PMU_EVENT_IDX_INVALID (0xFFFFFFFF). get_event_code() extracts the lower 16 bits, yielding 0xFFFF (65535), which is then used to index into kvpmu->fw_event[]. Since fw_event is only RISCV_KVM_MAX_FW_CTRS (32) entries, this triggers an array-index-out-of-bounds: UBSAN: array-index-out-of-bounds in arch/riscv/kvm/vcpu_pmu.c:255:37 index 65535 is out of range for type 'kvm_fw_event [32]' Add a bounds check on fevent_code before accessing the fw_event array, returning -EINVAL for invalid event codes. Fixes: badc386869e2c ("RISC-V: KVM: Support firmware events") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu --- arch/riscv/kvm/vcpu_pmu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index e873430e596b..c6d42459c2a1 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -252,6 +252,10 @@ static int pmu_ctr_read(struct kvm_vcpu *vcpu, unsigned long cidx, if (pmc->cinfo.type == SBI_PMU_CTR_TYPE_FW) { fevent_code = get_event_code(pmc->event_idx); + if (fevent_code >= SBI_PMU_FW_MAX) { + pr_warn("Invalid firmware event code [%d] for counter [%ld]\n", fevent_code, cidx); + return -EINVAL; + } pmc->counter_val = kvpmu->fw_event[fevent_code].value; } else if (pmc->perf_event) { pmc->counter_val += perf_event_read_value(pmc->perf_event, &enabled, &running); From patchwork Fri Mar 6 07:37:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiakai Xu X-Patchwork-Id: 2206028 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=H5wbAcyb; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4fRytj4ZrKz1xw1 for ; Fri, 06 Mar 2026 18:38:05 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=1eYvFDw/LpaLpeEC7x/FEdM0Y7aGSpYH8+RHCyQhYYs=; b=H5wbAcybIu6mxG W97uyiTSFicKFkkTnoTdb0uENIXBF/JfirYPJr9xK9ldtf4D8nnj+oBBLEdMcCVCHz1Oblo53NIL5 6FJaxhstPtN7bHZ9jXOOgq7LnPaaB83DvuxjH1vW9zbXjM7UQErDwK9pebORxAJG+y0Cd7EdvzSd0 3huUHucPS3JZNFI+ieVEdgdKMbK+gqDwEAXD4SXVWBmRHKFczTqU1xyp3G3xRuQjGj7+se3A51LkP XEag6PCNa/labjEE89fylul162vPazF6bNMgh8n3f6bTfYKXHODO3mTBsCSRaghqbaef6A0D0oE6g LqBiNvaFbQbPU/qxJvDQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vyPl5-00000003A0h-3ClL; Fri, 06 Mar 2026 07:38:03 +0000 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vyPl2-000000039zB-0VTw; Fri, 06 Mar 2026 07:38:02 +0000 Received: from fric.. (unknown [210.73.43.101]) by APP-05 (Coremail) with SMTP id zQCowAAXpglFhKppgcC9CQ--.1822S4; Fri, 06 Mar 2026 15:37:44 +0800 (CST) From: Jiakai Xu To: linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, kvm-riscv@lists.infradead.org, kvm@vger.kernel.org Cc: Andrew Jones , Alexandre Ghiti , Albert Ou , Palmer Dabbelt , Paul Walmsley , Atish Patra , Anup Patel , Jiakai Xu , Jiakai Xu Subject: [PATCH 2/2] RISC-V: KVM: Fix array out-of-bounds in pmu_fw_ctr_read_hi() Date: Fri, 6 Mar 2026 07:37:39 +0000 Message-Id: <20260306073739.3441292-3-xujiakai2025@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260306073739.3441292-1-xujiakai2025@iscas.ac.cn> References: <20260306073739.3441292-1-xujiakai2025@iscas.ac.cn> MIME-Version: 1.0 X-CM-TRANSID: zQCowAAXpglFhKppgcC9CQ--.1822S4 X-Coremail-Antispam: 1UD129KBjvJXoW7GF4DXr1fAr1Uur45Xw13urg_yoW8JrWrpr sFkFyag3s5trn2va4Yyw1DurWjyw4kKFZ0gr1j9F15Jr12vry3tFyDu3sxJr13AFW0qryI kw42kas7CFW5Xa7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQF14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJw A2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAa c4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzV Aqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S 6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxw ACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxG rwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4 vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IY x2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04k26c xKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAF wI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUSQ6JUUUUU= X-Originating-IP: [210.73.43.101] X-CM-SenderInfo: 50xmxthndljiysv6x2xfdvhtffof0/1tbiBwoSCWmqYzp40wAAsn X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260305_233800_540400_9D114C19 X-CRM114-Status: UNSURE ( 8.07 ) X-CRM114-Notice: Please train this message. X-Spam-Score: 0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: pmu_fw_ctr_read_hi() has the same issue as pmu_ctr_read(): when a guest reads a firmware counter that has not been configured, pmc->event_idx is SBI_PMU_EVENT_IDX_INVALID and get_event_code() returns [...] Content analysis details: (0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [159.226.251.25 listed in list.dnswl.org] 0.6 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in sa-trusted.bondedsender.org] 0.6 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in sa-accredit.habeas.com] 0.9 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [159.226.251.25 listed in bl.score.senderscore.com] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org pmu_fw_ctr_read_hi() has the same issue as pmu_ctr_read(): when a guest reads a firmware counter that has not been configured, pmc->event_idx is SBI_PMU_EVENT_IDX_INVALID and get_event_code() returns 0xFFFF, causing an out-of-bounds access on kvpmu->fw_event[]. Add the same bounds check on fevent_code before accessing the fw_event array. Fixes: 08fb07d6dcf71 ("RISC-V: KVM: Support 64 bit firmware counters on RV32") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu --- arch/riscv/kvm/vcpu_pmu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index c6d42459c2a1..b7ceda1643ec 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -227,6 +227,10 @@ static int pmu_fw_ctr_read_hi(struct kvm_vcpu *vcpu, unsigned long cidx, return -EINVAL; fevent_code = get_event_code(pmc->event_idx); + if (fevent_code >= SBI_PMU_FW_MAX) { + pr_warn("Invalid firmware event code [%d] for counter [%ld]\n", fevent_code, cidx); + return -EINVAL; + } pmc->counter_val = kvpmu->fw_event[fevent_code].value; *out_val = pmc->counter_val >> 32;