]> git.hungrycats.org Git - linux/commit
mshv: add bounds check on vp_index in mshv_intercept_isr()
authorJunrui Luo <moonafterrain@outlook.com>
Thu, 16 Apr 2026 14:18:05 +0000 (22:18 +0800)
committerWei Liu <wei.liu@kernel.org>
Mon, 8 Jun 2026 06:22:46 +0000 (23:22 -0700)
commita4ffc59238be84dd1c26bf1c001543e832674fc6
treedae6de451f8b0debde233d16d1a05295d96f7955
parent145613eb15eaed537825363a59523a0dcfa2d0f3
mshv: add bounds check on vp_index in mshv_intercept_isr()

mshv_intercept_isr() extracts vp_index from the hypervisor message
payload and uses it directly to index into pt_vp_array without
validation. handle_bitset_message() and handle_pair_message() already
validate vp_index against MSHV_MAX_VPS before array access.

Add the same MSHV_MAX_VPS bounds check for consistency with the other
message handlers.

Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
drivers/hv/mshv_synic.c