LoongArch: KVM: Handle the case that EIOINTC's coremap is empty

EIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently
we get a cpuid with -1 in this case, but we actually need 0 because it's
similar as the case that cpuid >= 4.

This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].

Cc: <stable@vger.kernel.org>
Fixes: 3956a52bc05bd81 ("LoongArch: KVM: Add EIOINTC read and write functions")
Reported-by: Aurelien Jarno <aurel32@debian.org>
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>

diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index d2acb4d09e73f5f3cc3e5a9d046db04e08e95070..c7badc8139238c1f9d68ca4858a5efb6b0cdda0b 100644 (file)
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -83,7 +83,7 @@ static inline void eiointc_update_sw_coremap(struct loongarch_eiointc *s,
 
                if (!(s->status & BIT(EIOINTC_ENABLE_CPU_ENCODE))) {
                        cpuid = ffs(cpuid) - 1;
-                       cpuid = (cpuid >= 4) ? 0 : cpuid;
+                       cpuid = ((cpuid < 0) || (cpuid >= 4)) ? 0 : cpuid;
                }
 
                vcpu = kvm_get_vcpu_by_cpuid(s->kvm, cpuid);