RISC-V: KVM: fix off-by-one array access in SBI PMU

The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest,
but it could only access another guest accessible data.

Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260227134617.23378-1-radim.krcmar@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index 4d8d5e9aa53d40f700605ec7011ddb9dc5a58dfd..aec6b293968b8b380529b10bdbd1b5916dc26c2a 100644 (file)
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx,
 {
        struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
 
-       if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
+       if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
                retdata->err_val = SBI_ERR_INVALID_PARAM;
                return 0;
        }