Currently there are no limit check at __emulate_int_real(), and normally greater numbers than the IDT limits needs to cause a #GP, but currently there is no limit check for doing that. So add a limit check for IDT to catch greater numbers than the IDT limit and if the number is greater than the IDT limit inject a #GP. Signed-off-by: Kayra Cizmeci --- v1: adds IDT limit check to __emulate_int_real(), link: https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@gmail.com/ v2: fixes the sign-extension of INT n, link: https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@gmail.com/ v3: rewrote commit messages, split 1 commit into 2 commits and rebased onto current mainline. arch/x86/kvm/emulate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index ec3138801bb7..68d099131d47 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -2023,7 +2023,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) gva_t eip_addr; u16 cs, eip; - /* TODO: Add limit checks */ + ops->get_idt(ctxt, &dt); + + if (dt.size < (irq << 2) + 3) + return emulate_gp(ctxt, 0); + ctxt->src.val = ctxt->eflags; rc = em_push(ctxt); if (rc != X86EMUL_CONTINUE) @@ -2041,8 +2045,6 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) if (rc != X86EMUL_CONTINUE) return rc; - ops->get_idt(ctxt, &dt); - eip_addr = dt.address + (irq << 2); cs_addr = dt.address + (irq << 2) + 2; -- 2.53.0