riscv: kvm: Fix out-of-bounds array access

In kvm_riscv_vcpu_sbi_init() the entry->ext_idx can contain an
out-of-bound index. This is used as a special marker for the base
extensions, that cannot be disabled. However, when traversing the
extensions, that special marker is not checked prior indexing the
array.

Add an out-of-bounds check to the function.

Fixes: 56d8a385b605 ("RISC-V: KVM: Allow some SBI extensions to be disabled by default")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20241104191503.74725-1-bjorn@kernel.org
Signed-off-by: Anup Patel <anup@brainfault.org>

diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c
index 7de128be8db9bcb68d2b990c4ee23ab9126c0218..6e704ed86a83a9c4f610d6836073c80e9b7620cc 100644 (file)
--- a/arch/riscv/kvm/vcpu_sbi.c
+++ b/arch/riscv/kvm/vcpu_sbi.c
@@ -486,19 +486,22 @@ void kvm_riscv_vcpu_sbi_init(struct kvm_vcpu *vcpu)
        struct kvm_vcpu_sbi_context *scontext = &vcpu->arch.sbi_context;
        const struct kvm_riscv_sbi_extension_entry *entry;
        const struct kvm_vcpu_sbi_extension *ext;
-       int i;
+       int idx, i;
 
        for (i = 0; i < ARRAY_SIZE(sbi_ext); i++) {
                entry = &sbi_ext[i];
                ext = entry->ext_ptr;
+               idx = entry->ext_idx;
+
+               if (idx < 0 || idx >= ARRAY_SIZE(scontext->ext_status))
+                       continue;
 
                if (ext->probe && !ext->probe(vcpu)) {
-                       scontext->ext_status[entry->ext_idx] =
-                               KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;
+                       scontext->ext_status[idx] = KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;
                        continue;
                }
 
-               scontext->ext_status[entry->ext_idx] = ext->default_disabled ?
+               scontext->ext_status[idx] = ext->default_disabled ?
                                        KVM_RISCV_SBI_EXT_STATUS_DISABLED :
                                        KVM_RISCV_SBI_EXT_STATUS_ENABLED;
        }