[xen master] ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir()

[patchbot@xxxxxxx]

commit be7f0cc651d8d02a95820792204c0558f1f29e03
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Mar 26 15:26:56 2025 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Thu Mar 27 11:54:23 2025 +0000

    ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir()
    
    The switch() statement is over bits 24:25 (unshifted) of the guest provided
    value.  This makes case 0x3: dead, and not an implementation of the 4th
    possible state.
    
    A guest which writes (0x3 << 24) | (0xff << 16) to this register will skip 
the
    early exit, then enter bitmap_for_each() with targets not bound by nr_vcpus.
    
    If the guest has fewer than 8 vCPUs, bitmap_for_each() will read off the end
    of d->vcpu[] and use the resulting vcpu pointer to ultimately derive irq, 
and
    perform out-of-bounds writes.
    
    Fix this by changing case 0x3 to default.
    
    Fixes: 08c688ca6422 ("ARM: new VGIC: Add SGIR register handler")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Volodymyr Babchuk <volodymyr_babchuk@xxxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
---
 xen/arch/arm/vgic/vgic-mmio-v2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/vgic/vgic-mmio-v2.c b/xen/arch/arm/vgic/vgic-mmio-v2.c
index 670b335db2..7d1391ac9b 100644
--- a/xen/arch/arm/vgic/vgic-mmio-v2.c
+++ b/xen/arch/arm/vgic/vgic-mmio-v2.c
@@ -104,7 +104,8 @@ static void vgic_mmio_write_sgir(struct vcpu *source_vcpu,
     case GICD_SGI_TARGET_SELF:                    /* this very vCPU only */
         targets = (1U << source_vcpu->vcpu_id);
         break;
-    case 0x3:                                     /* reserved */
+
+    default:
         return;
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#master