Skip to content

[PW_SID:1076807] RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()#1718

Closed
linux-riscv-bot wants to merge 13 commits into
workflow__riscv__fixesfrom
pw1076807
Closed

[PW_SID:1076807] RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()#1718
linux-riscv-bot wants to merge 13 commits into
workflow__riscv__fixesfrom
pw1076807

Conversation

@linux-riscv-bot
Copy link
Copy Markdown

@linux-riscv-bot linux-riscv-bot commented Apr 3, 2026

PR for series 1076807 applied to workflow__riscv__fixes

Name: RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1076807
Version: 1

Sean Chang and others added 13 commits February 18, 2026 20:49
riscv: fix various typos in comments and code
5d9d634 
Fix various typos in RISC-V architecture code and comments.
The following changes are included:

- arch/riscv/errata/thead/errata.c: "futher" → "further"
- arch/riscv/include/asm/atomic.h: "therefor" → "therefore", "arithmatic" → "arithmetic"
- arch/riscv/include/asm/elf.h: "availiable" → "available", "coorespends" → "corresponds"
- arch/riscv/include/asm/processor.h: "requries" → "is required"
- arch/riscv/include/asm/thread_info.h: "returing" → "returning"
- arch/riscv/kernel/acpi.c: "compliancy" → "compliance"
- arch/riscv/kernel/ftrace.c: "therefor" → "therefore"
- arch/riscv/kernel/head.S: "intruction" → "instruction"
- arch/riscv/kernel/mcount-dyn.S: "localtion → "location"
- arch/riscv/kernel/module-sections.c: "maxinum" → "maximum"
- arch/riscv/kernel/probes/kprobes.c: "reenabled" → "re-enabled"
- arch/riscv/kernel/probes/uprobes.c: "probbed" → "probed"
- arch/riscv/kernel/soc.c: "extremly" → "extremely"
- arch/riscv/kernel/suspend.c: "incosistent" → "inconsistent"
- arch/riscv/kvm/tlb.c: "cahce" → "cache"
- arch/riscv/kvm/vcpu_pmu.c: "indicies" → "indices"
- arch/riscv/lib/csum.c: "implmentations" → "implementations"
- arch/riscv/lib/memmove.S: "ammount" → "amount"
- arch/riscv/mm/cacheflush.c: "visable" → "visible"
- arch/riscv/mm/physaddr.c: "aginst" → "against"

Signed-off-by: Sean Chang <seanwascoding@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260212163325.60389-1-seanwascoding@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@dramforever
riscv: smp: Remove outdated comment about disabling preemption
37a14b6 
Commit f1a0a37 ("sched/core: Initialize the idle task with
preemption disabled") removed a call to preempt_disable(), but not the
associated comment. Remove the outdated comment.

Fixes: f1a0a37 ("sched/core: Initialize the idle task with preemption disabled")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Link: https://patch.msgid.link/20260204-riscv-smp-comment-update-2026-01-v1-1-8b77aa181530@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@dramforever
riscv: smp: Clarify comment "cache" -> "instruction cache"
4dd1663 
local_flush_icache_all() only flushes and synchronizes the *instruction*
cache, not the data cache. Since RISC-V does have a cbo.flush
instruction for data cache flush, clarify the comment to avoid
confusion.

Fixes: 58661a3 ("riscv: Flush the instruction cache during SMP bringup")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Link: https://patch.msgid.link/20260204-riscv-smp-comment-update-2026-01-v1-2-8b77aa181530@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
riscv: move kaslr_offset() to page.h as a static inline function
37f1490 
The kaslr_offset() function is a simple accessor that returns
kernel_map.virt_offset. This commit change also ensures that kaslr_offset()
is consistently available across various kernel configurations without
requiring explicit linkage to mm/init.c.

Signed-off-by: Austin Kim <austin.kim@lge.com>
Link: https://patch.msgid.link/aYwJ76yHaMbbQVJA@adminpc-PowerEdge-R7525
Signed-off-by: Paul Walmsley <pjw@kernel.org>
riscv: export kaslr offset and satp in VMCOREINFO ELF notes
097da80 
The following options are required by the kdump crash utility for RISC-V
based vmcore file:

- kaslr: If the vmcore is generated from a KASLR-enabled Linux kernel,
         the KASLR offset is required for the crash utility to load
         the vmcore. Without the proper kaslr option, the crash utility
         fails to load the vmcore file.
- satp: The exact root page table address helps determine the correct base
        PGD address.

With this patch, RISC-V VMCOREINFO ELF notes now include both kaslr
and satp information.

Signed-off-by: Austin Kim <austin.kim@lge.com>
Link: https://patch.msgid.link/aYwKUE3ZzN7/ZY/A@adminpc-PowerEdge-R7525
Signed-off-by: Paul Walmsley <pjw@kernel.org>
riscv: kgdb: fix several debug register assignment bugs
1121200 
Fix several bugs in the RISC-V kgdb implementation:

- The element of dbg_reg_def[] that is supposed to pertain to the S1
  register embeds instead the struct pt_regs offset of the A1
  register.  Fix this to use the S1 register offset in struct pt_regs.

- The sleeping_thread_to_gdb_regs() function copies the value of the
  S10 register into the gdb_regs[] array element meant for the S9
  register, and copies the value of the S11 register into the array
  element meant for the S10 register.  It also neglects to copy the
  value of the S11 register.  Fix all of these issues.

Fixes: fe89bd2 ("riscv: Add KGDB support")
Cc: Vincent Chen <vincent.chen@sifive.com>
Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@dramforever
riscv: patch: Avoid early phys_to_page()
3a87650 
Similarly to commit 8d09e2d ("arm64: patching: avoid early
page_to_phys()"), avoid using phys_to_page() for the kernel address case
in patch_map().

Since this is called from apply_boot_alternatives() in setup_arch(), and
commit 4267739 ("arch, mm: consolidate initialization of SPARSE
memory model") has moved sparse_init() to after setup_arch(),
phys_to_page() is not available there yet, and it panics on boot with
SPARSEMEM on RV32, which does not use SPARSEMEM_VMEMMAP.

Reported-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Closes: https://lore.kernel.org/r/20260223144108-dcace0b9-02e8-4b67-a7ce-f263bed36f26@linutronix.de/
Fixes: 4267739 ("arch, mm: consolidate initialization of SPARSE memory model")
Suggested-by: Mike Rapoport <rppt@kernel.org>
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20260310-riscv-sparsemem-alternatives-fix-v1-1-659d5dd257e2@iscas.ac.cn
[pjw@kernel.org: fix the subject line to align with the patch description]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@ukleinek
riscv: Simplify assignment for UTS_MACHINE
1351ac7 
The BITS variable conveniently allows to simplify the assignment for
UTS_MACHINE.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260313164012.1153936-2-u.kleine-koenig@baylibre.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@thecharlesjenkins
selftests: riscv: Add definition of BIT() macro
e93c297 
The BIT() macros is used by the validate_v_ptrace() test case, but not
defined. Include linux/bits.h to pull in this definition. To ensure that
the header in the kernel source is used, add tools/include to the header
search path.

Fixes: 30eb191 ("selftests: riscv: verify ptrace rejects invalid vector csr inputs")
Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Reviewed-and-tested-by: Sergey Matyukevich <geomatsi@gmail.com>
Link: https://patch.msgid.link/20260309-fix_selftests-v2-1-9d5a553a531e@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@thecharlesjenkins
riscv: ptrace: Fix BIT() compilation issues
b1b59c4 
BIT() is being used in ptrace.h without a definition, resulting in
compilation errors in tools/testing/selftests/riscv/cfi/cfitests.c:

cfitests.c:101:60: error: implicit declaration of function ‘BIT’ [-Wimplicit-function-declaration]
  101 |                      if ((cfi_reg.cfi_status.cfi_state & CFI_ENABLE_MASK) != CFI_ENABLE_MASK)

Include linux/bits.h to resolve this issue.

Fixes: 2af7c9c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files")
Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Reviewed-by: Deepak Gupta <debug@rivosinc.com>
Link: https://patch.msgid.link/20260309-fix_selftests-v2-3-9d5a553a531e@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
@thecharlesjenkins
selftests: riscv: Add license to cfi selftest
5ccc568 
The cfi selftest was missing a license so add it.

Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Reviewed-by: Deepak Gupta <debug@rivosinc.com>
Link: https://patch.msgid.link/20260309-fix_selftests-v2-4-9d5a553a531e@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Adding CI files
c315cbf
@6eanut
RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()
fe12180 
The make_xfence_request() function uses a shift operation to check if a
vCPU is in the hart mask:

  if (!(hmask & (1UL << (vcpu->vcpu_id - hbase))))

However, when the difference between vcpu_id and hbase
is >= BITS_PER_LONG, the shift operation causes undefined behavior.

This was detected by UBSAN:
  UBSAN: shift-out-of-bounds in arch/riscv/kvm/tlb.c:343:23
  shift exponent 256 is too large for 64-bit type 'long unsigned int'

Fix this by adding a bounds check before the shift operation.

This bug was found by fuzzing the KVM RISC-V interface.

Fixes: 13acfec ("RISC-V: KVM: Add remote HFENCE functions based on VCPU requests")
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 136.65 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1019.74 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1373.92 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 26.56 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 28.08 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.77 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 82.02 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
kdoc
Desc: Detects for kdoc errors
Duration: 0.81 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
module-param
Desc: Detect module_param changes
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.27 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

linux-riscv-bot commented Apr 3, 2026

Patch 1: "RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.29 seconds
Result: PASS

@linux-riscv-bot linux-riscv-bot force-pushed the workflow__riscv__fixes branch from c315cbf to 027705f Compare April 3, 2026 08:50
@linux-riscv-bot linux-riscv-bot deleted the pw1076807 branch April 3, 2026 08:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@linux-riscv-bot @dramforever @ukleinek @thecharlesjenkins @6eanut