[xen staging-4.18] ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir()

[patchbot@xxxxxxx]

commit 022596f53f96ee83c6ad8be608e3ab84d2fd2ab2
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Apr 2 14:31:17 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Apr 2 14:31:17 2025 +0200

    ARM/vgic: Fix out-of-bounds accesses in vgic_mmio_write_sgir()
    
    The switch() statement is over bits 24:25 (unshifted) of the guest provided
    value.  This makes case 0x3: dead, and not an implementation of the 4th
    possible state.
    
    A guest which writes (0x3 << 24) | (0xff << 16) to this register will skip 
the
    early exit, then enter bitmap_for_each() with targets not bound by nr_vcpus.
    
    If the guest has fewer than 8 vCPUs, bitmap_for_each() will read off the end
    of d->vcpu[] and use the resulting vcpu pointer to ultimately derive irq, 
and
    perform out-of-bounds writes.
    
    Fix this by changing case 0x3 to default.
    
    Fixes: 08c688ca6422 ("ARM: new VGIC: Add SGIR register handler")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Volodymyr Babchuk <volodymyr_babchuk@xxxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    master commit: be7f0cc651d8d02a95820792204c0558f1f29e03
    master date: 2025-03-27 11:54:23 +0000
---
 xen/arch/arm/vgic/vgic-mmio-v2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/vgic/vgic-mmio-v2.c b/xen/arch/arm/vgic/vgic-mmio-v2.c
index 2e507b10fe..e14de567a7 100644
--- a/xen/arch/arm/vgic/vgic-mmio-v2.c
+++ b/xen/arch/arm/vgic/vgic-mmio-v2.c
@@ -104,7 +104,8 @@ static void vgic_mmio_write_sgir(struct vcpu *source_vcpu,
     case GICD_SGI_TARGET_SELF:                    /* this very vCPU only */
         targets = (1U << source_vcpu->vcpu_id);
         break;
-    case 0x3:                                     /* reserved */
+
+    default:
         return;
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.18