KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR

Make sure we filter out non-LPI invalidation when handling writes
to GICR_INVLPIR.

Fixes: 4645d11f4a553 ("KVM: arm64: vgic-v3: Implement MMIO-based LPI invalidation")
Reported-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20241117165757.247686-2-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>

diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 9e50928f5d7dfd22880f8fb874a6bebb16f36989..70a44852cbafe303bd8ca83916d60c9d96ecf3ac 100644 (file)
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -530,6 +530,7 @@ static void vgic_mmio_write_invlpi(struct kvm_vcpu *vcpu,
                                   unsigned long val)
 {
        struct vgic_irq *irq;
+       u32 intid;
 
        /*
         * If the guest wrote only to the upper 32bit part of the
@@ -541,9 +542,13 @@ static void vgic_mmio_write_invlpi(struct kvm_vcpu *vcpu,
        if ((addr & 4) || !vgic_lpis_enabled(vcpu))
                return;
 
+       intid = lower_32_bits(val);
+       if (intid < VGIC_MIN_LPI)
+               return;
+
        vgic_set_rdist_busy(vcpu, true);
 
-       irq = vgic_get_irq(vcpu->kvm, NULL, lower_32_bits(val));
+       irq = vgic_get_irq(vcpu->kvm, NULL, intid);
        if (irq) {
                vgic_its_inv_lpi(vcpu->kvm, irq);
                vgic_put_irq(vcpu->kvm, irq);