[PATCH] KVM: arm64: GICv2: Bound the INTID in vgic_v2_deactivate()

[Marc Zyngier]

On Sat, 25 Jul 2026 16:40:20 +0100,
Karl Mehltretter <kmehltretter at gmail.com> wrote:
> 
> vgic_v2_deactivate() passes the INTID from a trapped GICV_DIR write to
> vgic_get_vcpu_irq() without checking it against the number of
> implemented interrupts. An out-of-range INTID makes the lookup return
> NULL and triggers WARN_ON_ONCE(!irq).
> 
> A guest using EOImode=1 can therefore raise a host warning, or panic a
> host with panic_on_warn=1.
> 
> The GICv3 counterpart rejects INTIDs outside the configured SGI, PPI and
> SPI range before performing the lookup. Add the same check to the GICv2
> path.
>
> Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
> Cc: stable at vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Karl Mehltretter <kmehltretter at gmail.com>
> ---
>  arch/arm64/kvm/vgic/vgic-v2.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c
> index cafa3cb32bda..42430c0fee07 100644
> --- a/arch/arm64/kvm/vgic/vgic-v2.c
> +++ b/arch/arm64/kvm/vgic/vgic-v2.c
> @@ -163,8 +163,12 @@ void vgic_v2_deactivate(struct kvm_vcpu *vcpu, u32 val)
>  	cpuid = FIELD_GET(GENMASK_ULL(12, 10), val);
>  	val &= ~GENMASK_ULL(12, 10);
>  
> -	/* We only deal with DIR when EOIMode==1 */
> -	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK))
> +	/*
> +	 * We only deal with DIR when EOIMode==1, and only for SGI,
> +	 * PPI or SPI.
> +	 */
> +	if (!(cpuif->vgic_vmcr & GICH_VMCR_EOI_MODE_MASK) ||
> +	    val >= vcpu->kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)
>  		return;

This duplicates the existing check, as GICv2 has no LPIs. I'd rather
drop the WARN_ON() altogether.

Thanks,

	M.

-- 
Jazz isn't dead. It just smells funny.