Hi Andrew,
Andrew Cooper <andrew.coop...@citrix.com> writes:
> The switch() statement is over bits 24:25 (unshifted) of the guest provided
> value. This makes case 0x3: dead, and not an implementation of the 4th
> possible state.
>
> A guest which writes (3<<24)|(ff<<16) to this register will skip the early
> exit, then enter bitmap_for_each() with targets not bound by nr_vcpus.
>
> If the guest has fewer than 8 vCPUs, bitmap_for_each() will read off the end
> of d->vcpu[] and use the resulting vcpu pointer to ultimately derive irq, and
> perform an out-of-bounds write.
>
> Fix this by changing case 0x3 to default.
>
> Fixes: 08c688ca6422 ("ARM: new VGIC: Add SGIR register handler")
> Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com>
Reviewed-by: Volodymyr Babchuk <volodymyr_babc...@epam.com>
> ---
> CC: Stefano Stabellini <sstabell...@kernel.org>
> CC: Julien Grall <jul...@xen.org>
> CC: Volodymyr Babchuk <volodymyr_babc...@epam.com>
> CC: Bertrand Marquis <bertrand.marq...@arm.com>
> CC: Michal Orzel <michal.or...@amd.com>
>
> This vgic driver is explicity not security supported, hence no XSA.
> ---
> xen/arch/arm/vgic/vgic-mmio-v2.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/xen/arch/arm/vgic/vgic-mmio-v2.c
> b/xen/arch/arm/vgic/vgic-mmio-v2.c
> index 670b335db2c3..7d1391ac9b48 100644
> --- a/xen/arch/arm/vgic/vgic-mmio-v2.c
> +++ b/xen/arch/arm/vgic/vgic-mmio-v2.c
> @@ -104,7 +104,8 @@ static void vgic_mmio_write_sgir(struct vcpu *source_vcpu,
> case GICD_SGI_TARGET_SELF: /* this very vCPU only */
> targets = (1U << source_vcpu->vcpu_id);
> break;
> - case 0x3: /* reserved */
> +
> + default:
> return;
> }
--
WBR, Volodymyr
