]> git.ipfire.org Git - thirdparty/linux.git/commit
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
authorJunrui Luo <moonafterrain@outlook.com>
Wed, 15 Apr 2026 09:26:55 +0000 (17:26 +0800)
committerChristian Borntraeger <borntraeger@linux.ibm.com>
Fri, 17 Apr 2026 11:12:07 +0000 (13:12 +0200)
commit16d990a15491cf76cd6eef0846e1b4100e63261a
tree09c92145631042af77127ef4f56ca1cae7ff87e1
parent028ef9c96e96197026887c0f092424679298aae8
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and
aen_host_forward() index the GAIT by manually multiplying the index
with sizeof(struct zpci_gaite).

Since aift->gait is already a struct zpci_gaite pointer, this
double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with
ZPCI_NR_DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Fixes: 73f91b004321 ("KVM: s390: pci: enable host forwarding of Adapter Event Notifications")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
arch/s390/kvm/interrupt.c
arch/s390/kvm/pci.c