From: Andrew Cooper Date: Wed, 2 Apr 2025 12:27:56 +0000 (+0200) Subject: ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir() X-Git-Tag: RELEASE-4.19.2~16 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=f0a30501613f4ddb725e164b208c64073faa0e01;p=xen.git ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir() The switch() statement is over bits 24:25 (unshifted) of the guest provided value. This makes case 0x3: dead, and not an implementation of the 4th possible state. A guest which writes (0x3 << 24) | (0xff << 16) to this register will skip the early exit, then enter bitmap_for_each() with targets not bound by nr_vcpus. If the guest has fewer than 8 vCPUs, bitmap_for_each() will read off the end of d->vcpu[] and use the resulting vcpu pointer to ultimately derive irq, and perform out-of-bounds writes. Fix this by changing case 0x3 to default. Fixes: 08c688ca6422 ("ARM: new VGIC: Add SGIR register handler") Signed-off-by: Andrew Cooper Reviewed-by: Volodymyr Babchuk Reviewed-by: Stefano Stabellini master commit: be7f0cc651d8d02a95820792204c0558f1f29e03 master date: 2025-03-27 11:54:23 +0000 --- diff --git a/xen/arch/arm/vgic/vgic-mmio-v2.c b/xen/arch/arm/vgic/vgic-mmio-v2.c index 2e507b10fe..e14de567a7 100644 --- a/xen/arch/arm/vgic/vgic-mmio-v2.c +++ b/xen/arch/arm/vgic/vgic-mmio-v2.c @@ -104,7 +104,8 @@ static void vgic_mmio_write_sgir(struct vcpu *source_vcpu, case GICD_SGI_TARGET_SELF: /* this very vCPU only */ targets = (1U << source_vcpu->vcpu_id); break; - case 0x3: /* reserved */ + + default: return; }