[PATCH v3 2/2] KVM: x86: Add limit check to IDT in __emulate_int_real()

[Kayra Cizmeci]

Currently there are no limit check at __emulate_int_real(),
and normally greater numbers than the IDT limits needs to
cause a #GP, but currently there is no limit check for doing that.

So add a limit check for IDT to catch greater numbers than the IDT
limit and if the number is greater than the IDT limit inject a #GP.

Signed-off-by: Kayra Cizmeci <kayracizmeci@xxxxxxxxx>
---
v1: adds IDT limit check to __emulate_int_real(), link:
https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@xxxxxxxxx/
v2: fixes the sign-extension of INT n, link:
https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@xxxxxxxxx/
v3: rewrote commit messages, split 1 commit into 2 commits and rebased
onto current mainline.

 arch/x86/kvm/emulate.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index ec3138801bb7..68d099131d47 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2023,7 +2023,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
 	gva_t eip_addr;
 	u16 cs, eip;
 
-	/* TODO: Add limit checks */
+	ops->get_idt(ctxt, &dt);
+
+	if (dt.size < (irq << 2) + 3)
+		return emulate_gp(ctxt, 0);
+
 	ctxt->src.val = ctxt->eflags;
 	rc = em_push(ctxt);
 	if (rc != X86EMUL_CONTINUE)
@@ -2041,8 +2045,6 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
 
-	ops->get_idt(ctxt, &dt);
-
 	eip_addr = dt.address + (irq << 2);
 	cs_addr = dt.address + (irq << 2) + 2;
 
-- 
2.53.0