[PATCH 5/5] KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs

[Sascha Bischoff]

GICv5 supports up to 128 PPIs. In KVM, we have chosen to only support
the first 64 which correspond to the architected set of PPIs.

The GICv5 PPI helper checks only the encoded interrupt type (the top
bits of the interrupt ID). An encoded PPI with an ID outside KVM's
supported private-interrupt range therefore reaches the lookup, where
array_index_nospec() clamps it to zero and aliases private IRQ 0.

Reject out-of-range GICv5 PPI IDs before looking up the private IRQ.

Fixes: 4d591252bacb ("KVM: arm64: gic-v5: Implement PPI interrupt injection")
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27
Signed-off-by: Sascha Bischoff <sascha.bischoff at arm.com>
---
 arch/arm64/kvm/vgic/vgic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 352d52bd6315c..b25303d9919fd 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -118,6 +118,8 @@ struct vgic_irq *vgic_get_vcpu_irq(struct kvm_vcpu *vcpu, u32 intid)
 		switch (type) {
 		case KVM_DEV_TYPE_ARM_VGIC_V5:
 			intid = vgic_v5_get_hwirq_id(intid);
+			if (intid >= VGIC_V5_NR_PRIVATE_IRQS)
+				return NULL;
 			intid = array_index_nospec(intid, VGIC_V5_NR_PRIVATE_IRQS);
 			break;
 		default:
-- 
2.34.1