linux/arch/arm64/kvm/vgic
Michael Bommarito 9ce754ed8e KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports.  The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.

Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device.  This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range.

Fixes: 57a9a11715 ("KVM: arm64: vgic-its: Device table save/restore")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://lore.kernel.org/r/20260519132519.2142458-1-michael.bommarito@gmail.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
2026-05-20 08:08:11 +01:00
..
trace.h
vgic-debug.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vgic-init.c KVM: arm64: Don't advertises GICv3 in ID_PFR1_EL1 if AArch32 isn't supported 2026-04-01 15:42:26 +01:00
vgic-irqfd.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
vgic-its.c KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits 2026-05-20 08:08:11 +01:00
vgic-kvm-device.c KVM: arm64: gic-v5: Communicate userspace-driveable PPIs via a UAPI 2026-03-19 18:21:29 +00:00
vgic-mmio-v2.c KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value 2026-04-24 12:03:47 +01:00
vgic-mmio-v3.c KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value 2026-04-24 12:03:47 +01:00
vgic-mmio.c KVM: arm64: gic-v5: Implement GICv5 load/put and save/restore 2026-03-19 18:21:28 +00:00
vgic-mmio.h KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps 2025-11-24 14:29:14 -08:00
vgic-v2.c KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail 2026-03-07 21:45:58 +00:00
vgic-v3-nested.c Merge branch kvm-arm64/misc-6.20 into kvmarm-master/next 2026-02-05 09:17:58 +00:00
vgic-v3.c KVM: arm64: vgic: Rework vgic_is_v3() and add vgic_host_has_gicvX() 2026-03-19 16:25:55 +00:00
vgic-v4.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
vgic-v5.c KVM: arm64: vgic-v5: Fold PPI state for all exposed PPIs 2026-04-01 17:52:17 +01:00
vgic.c KVM: arm64: gic-v5: Support GICv5 interrupts with KVM_IRQ_LINE 2026-03-19 18:21:28 +00:00
vgic.h KVM: arm64: gic-v5: Initialise ID and priority bits when resetting vcpu 2026-03-19 18:21:28 +00:00