[xen master] arm/vgic-v3: Fix data abort in get_vcpu_from_rdist()

[patchbot@xxxxxxx]

commit 7ad6cfa66fbd8d5e5569b65d2c8085ecc5e672f1
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jul 8 13:12:52 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 14 12:10:44 2026 +0100

    arm/vgic-v3: Fix data abort in get_vcpu_from_rdist()
    
    Just because vcpu_id is within d->max_vcpus doesn't mean d->vcpu[vcpu_id] is
    non-NULL.  Use the proper accessor to look up a vcpu object.
    
    Reported-by: Michal Orzel <michal.orzel@xxxxxxx>
    Fixes: acf65e5a25a7 ("xen/arm: vgic-v3: Emulate correctly the 
re-distributor")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Julien Grall <julien@xxxxxxx>
---
 xen/arch/arm/vgic-v3.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c
index c1c4d6f71e..c01cc596d5 100644
--- a/xen/arch/arm/vgic-v3.c
+++ b/xen/arch/arm/vgic-v3.c
@@ -1111,10 +1111,10 @@ static struct vcpu *get_vcpu_from_rdist(struct domain 
*d,
     unsigned int vcpu_id;
 
     vcpu_id = region->first_cpu + ((gpa - region->base) / GICV3_GICR_SIZE);
-    if ( unlikely(vcpu_id >= d->max_vcpus) )
-        return NULL;
 
-    v = d->vcpu[vcpu_id];
+    v = domain_vcpu(d, vcpu_id);
+    if ( !v )
+        return NULL;
 
     *offset = gpa - v->arch.vgic.rdist_base;
 
--
generated by git-patchbot for /home/xen/git/xen.git#master