]> git.ipfire.org Git - thirdparty/linux.git/commit
RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized
authorJiakai Xu <jiakaipeanut@gmail.com>
Tue, 27 Jan 2026 08:43:13 +0000 (08:43 +0000)
committerAnup Patel <anup@brainfault.org>
Fri, 6 Feb 2026 13:35:12 +0000 (19:05 +0530)
commit003b9dae53ae795930c54945e0b0a41bbd527b44
tree37874183d3f0da59d374270c1b00ff0356685000
parentaeb1d17d1af5924f7357d7204a293bd8fc06ea13
RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized

kvm_riscv_vcpu_aia_imsic_update() assumes that the vCPU IMSIC state has
already been initialized and unconditionally accesses imsic->vsfile_lock.
However, in fuzzed ioctl sequences, the AIA device may be initialized at
the VM level while the per-vCPU IMSIC state is still NULL.

This leads to invalid access when entering the vCPU run loop before
IMSIC initialization has completed.

The crash manifests as:
  Unable to handle kernel paging request at virtual address
  dfffffff00000006
  ...
  kvm_riscv_vcpu_aia_imsic_update arch/riscv/kvm/aia_imsic.c:801
  kvm_riscv_vcpu_aia_update arch/riscv/kvm/aia_device.c:493
  kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:927
  ...

Add a guard to skip the IMSIC update path when imsic_state is NULL. This
allows the vCPU run loop to continue safely.

This issue was discovered during fuzzing of RISC-V KVM code.

Fixes: db8b7e97d6137a ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC")
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260127084313.3496485-1-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
arch/riscv/kvm/aia_imsic.c