On Sun, Mar 08, 2026 at 02:38:02AM +0000, Jiakai Xu wrote:
> When a guest invokes SBI_EXT_PMU_COUNTER_FW_READ or
> SBI_EXT_PMU_COUNTER_FW_READ_HI on a firmware counter that has not been
> configured via SBI_EXT_PMU_COUNTER_CFG_MATCH, the pmc->event_idx remains
> SBI_PMU_EVENT_IDX_INVALID (0xFFFFFFFF). get_event_code() extracts the
> lower 16 bits, yielding 0xFFFF (65535), which is then used to index into
> kvpmu->fw_event[]. Since fw_event is only RISCV_KVM_MAX_FW_CTRS (32)
> entries, this triggers an array-index-out-of-bounds:
>
> UBSAN: array-index-out-of-bounds in arch/riscv/kvm/vcpu_pmu.c:255:37
> index 65535 is out of range for type 'kvm_fw_event [32]'
>
> Add a bounds check on fevent_code before accessing the fw_event array,
> returning -EINVAL for invalid event codes.
>
> Fixes: badc386869e2c ("RISC-V: KVM: Support firmware events")
> Fixes: 08fb07d6dcf71 ("RISC-V: KVM: Support 64 bit firmware counters on RV32")
> Signed-off-by: Jiakai Xu <[email protected]>
> Signed-off-by: Jiakai Xu <[email protected]>
> ---
> V1 -> V2:
> - Merged the fixes for pmu_ctr_read() and pmu_fw_ctr_read_hi() into a single
> commit.
> - Removed the pr_warn, simply returning -EINVAL instead.
> ---
> arch/riscv/kvm/vcpu_pmu.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
> index e873430e596b..2ab67f5b99dc 100644
> --- a/arch/riscv/kvm/vcpu_pmu.c
> +++ b/arch/riscv/kvm/vcpu_pmu.c
> @@ -227,6 +227,8 @@ static int pmu_fw_ctr_read_hi(struct kvm_vcpu *vcpu,
> unsigned long cidx,
> return -EINVAL;
>
> fevent_code = get_event_code(pmc->event_idx);
> + if (fevent_code >= SBI_PMU_FW_MAX)
A test of just 'pmc->event_idx == SBI_PMU_EVENT_IDX_INVALID' should be
sufficient since we shouldn't have random values in pmc->event_idx. But,
some defensive coding here might be a good idea, so the way the patch
is written looks reasonable to me. Or, we could do something like
if (pmc->event_idx == SBI_PMU_EVENT_IDX_INVALID ||
WARN_ONCE(fevent_code >= SBI_PMU_FW_MAX))
return -EINVAL;
to try and express the intent better.
Thanks,
drew
> + return -EINVAL;
> pmc->counter_val = kvpmu->fw_event[fevent_code].value;
>
> *out_val = pmc->counter_val >> 32;
> @@ -252,6 +254,8 @@ static int pmu_ctr_read(struct kvm_vcpu *vcpu, unsigned
> long cidx,
>
> if (pmc->cinfo.type == SBI_PMU_CTR_TYPE_FW) {
> fevent_code = get_event_code(pmc->event_idx);
> + if (fevent_code >= SBI_PMU_FW_MAX)
> + return -EINVAL;
> pmc->counter_val = kvpmu->fw_event[fevent_code].value;
> } else if (pmc->perf_event) {
> pmc->counter_val += perf_event_read_value(pmc->perf_event,
> &enabled, &running);
> --
> 2.34.1
>
