[PATCH v2 4/4] KVM: arm64: Validate GICv5 timer PPIs before claiming ownership

[Joey Gouly]

On Tue, Aug 11, 2026 at 03:11:48PM +0000, Sascha Bischoff wrote:
> With GICv5, timer PPIs use architecturally defined IDs, and therefore
> we require userspace to use the architected IDs too. We perform this
> validation in timer_irqs_are_valid(), which validates the configured
> PPI after claiming it with kvm_vgic_set_owner(). This is obviously the
> wrong order, and could both result in a NULL pointer dereference for
> an ID >= 64 and in an incorrect ownership claim.
> 
> Switch the order to first validate the PPI before setting the
> owner. This both prevents an invalid GICv5 timer PPI from reaching the
> IRQ lookup, and avoids claiming an IRQ for a timer configuration that
> will be rejected.
> 
> Fixes: 06c85b58e0b1 ("KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid()")
> Link: https://sashiko.dev/#/message/20260810111614.DDC731F000E9%40smtp.kernel.org
> Signed-off-by: Sascha Bischoff <sascha.bischoff at arm.com>
> ---
>  arch/arm64/kvm/arch_timer.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
> index 4155fe89b58a1..af7e2894cd690 100644
> --- a/arch/arm64/kvm/arch_timer.c
> +++ b/arch/arm64/kvm/arch_timer.c
> @@ -1529,13 +1529,14 @@ static bool timer_irqs_are_valid(struct kvm_vcpu *vcpu)
>  
>  		ctx = vcpu_get_timer(vcpu, i);
>  		irq = timer_irq(ctx);
> -		if (kvm_vgic_set_owner(vcpu, irq, ctx))
> -			break;
>  
>  		/* With GICv5, the default PPI is what you get -- nothing else */
>  		if (vgic_is_v5(vcpu->kvm) && irq != get_vgic_ppi(vcpu->kvm, default_ppi[i]))
>  			break;
>  
> +		if (kvm_vgic_set_owner(vcpu, irq, ctx))
> +			break;
> +
>  		/*
>  		 * We know by construction that we only have PPIs, so all values
>  		 * are less than 32 for non-GICv5 VGICs. On GICv5, they are

Reviewed-by: Joey Gouly <joey.gouly at arm.com>