From: Stanislav Kinsburskii <[email protected]> Sent: Thursday, May 7, 2026 8:43 AM > > mshv_try_assert_irq_fast() dereferences the vp pointer obtained from > pt_vp_array[lapic_apic_id] without checking for NULL or validating that > lapic_apic_id is within bounds. A spurious interrupt from the hypervisor > targeting a non-existent VP (or one not yet created) causes a NULL > pointer dereference and crashes the host. > > Add a bounds check on lapic_apic_id against MSHV_MAX_VPS and a NULL > check on the vp pointer before dereferencing. > > Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose > /dev/mshv to VMMs") > Signed-off-by: Stanislav Kinsburskii <[email protected]> > --- > drivers/hv/mshv_eventfd.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c > index 5995a62aff8d8..b398e58411dd7 100644 > --- a/drivers/hv/mshv_eventfd.c > +++ b/drivers/hv/mshv_eventfd.c > @@ -169,7 +169,12 @@ static int mshv_try_assert_irq_fast(struct mshv_irqfd > *irqfd) > return -EOPNOTSUPP; > #endif > > + if (irq->lapic_apic_id >= MSHV_MAX_VPS) > + return -EINVAL;
APIC IDs are 8-bit values, and indeed lapic_apic_id is set in mshv_copy_girq_info() after masking the value with 0xFF. So this check doesn't do anything. (I guess MSHV_MAX_VPS could be changed to something smaller than 256, but that seems highly unlikely.) There is extended destination id functionality that provides for a 15-bit APIC ID, but I don't see any support for that in the MSHV code. > + > vp = partition->pt_vp_array[irq->lapic_apic_id]; The APIC ID does *not* equal the Linux CPU number or VP index in the general case, so this indexing is problematic. APIC IDs are not dense if the target partition has multiple NUMA nodes and the number of VPs in a NUMA node is not a power of 2. In such case, the APIC ID space has gaps. Azure has such VM sizes, and you can create such a configuration using the local Hyper-V Manager UI. So having APIC IDs that aren't dense is a real case. > + if (!vp) > + return -EINVAL; > > if (!vp->vp_register_page) > return -EOPNOTSUPP; > >
