mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-11 02:59:12 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch/x86/kvm
History
Wanpeng Li dcbd3e49c2 KVM: X86: Fix NULL deref in vcpu_scan_ioapic 
Reported by syzkaller:

    CPU: 1 PID: 5962 Comm: syz-executor118 Not tainted 4.20.0-rc6+ #374
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:kvm_apic_hw_enabled arch/x86/kvm/lapic.h:169 [inline]
    RIP: 0010:vcpu_scan_ioapic arch/x86/kvm/x86.c:7449 [inline]
    RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:7602 [inline]
    RIP: 0010:vcpu_run arch/x86/kvm/x86.c:7874 [inline]
    RIP: 0010:kvm_arch_vcpu_ioctl_run+0x5296/0x7320 arch/x86/kvm/x86.c:8074
    Call Trace:
	 kvm_vcpu_ioctl+0x5c8/0x1150 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2596
	 vfs_ioctl fs/ioctl.c:46 [inline]
	 file_ioctl fs/ioctl.c:509 [inline]
	 do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696
	 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713
	 __do_sys_ioctl fs/ioctl.c:720 [inline]
	 __se_sys_ioctl fs/ioctl.c:718 [inline]
	 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
	 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT14 msr
and triggers scan ioapic logic to load synic vectors into EOI exit bitmap.
However, irqchip is not initialized by this simple testcase, ioapic/apic
objects should not be accessed.

This patch fixes it by also considering whether or not apic is present.

Reported-by: syzbot+39810e6c400efadfef71@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-12-18 22:15:44 +01:00
..
cpuid.c KVM: X86: Implement "send IPI" hypercall 2018-08-06 17:59:20 +02:00
cpuid.h KVM/x86: Update the reverse_cpuid list to include CPUID_7_EDX 2018-02-03 23:06:51 +01:00
debugfs.c kvm: x86: export TSC information to user-space 2016-09-16 16:57:48 +02:00
emulate.c x86: Clean up 'sizeof x' => 'sizeof(x)' 2018-10-29 07:13:28 +01:00
hyperv.c x86/kvm/hyperv: don't clear VP assist pages on init 2018-10-17 00:30:17 +02:00
hyperv.h KVM: hyperv: define VP assist page helpers 2018-10-17 00:30:13 +02:00
i8254.c KVM: x86: take slots_lock in kvm_free_pit 2017-07-12 22:38:26 +02:00
i8254.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
i8259.c KVM: x86: simplify pic_ioport_read() 2017-04-12 20:17:15 +02:00
ioapic.c KVM: x86: ioapic: Preserve read-only values in the redirection table 2017-11-17 13:20:21 +01:00
ioapic.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
irq.c KVM: x86: Rename interrupt.pending to interrupt.injected 2018-03-28 22:47:06 +02:00
irq.h KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING 2017-05-02 14:45:45 +02:00
irq_comm.c KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING 2017-05-02 14:45:45 +02:00
Kconfig x86/kvm/Kconfig: Ensure CRYPTO_DEV_CCP_DD state at minimum matches KVM_AMD 2018-07-15 17:36:57 +02:00
kvm_cache_regs.h KVM: nVMX: Do not load EOI-exitmap while running L2 2018-03-21 14:16:44 +01:00
lapic.c KVM: x86: fix empty-body warnings 2018-11-27 12:50:09 +01:00
lapic.h KVM: hyperv: define VP assist page helpers 2018-10-17 00:30:13 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mmu.c kvm: mmu: Fix race in emulated page table writes 2018-11-27 12:50:31 +01:00
mmu.h x86/kvm/mmu: make vcpu->mmu a pointer to the current MMU 2018-10-17 00:30:02 +02:00
mmu_audit.c x86/kvm/mmu: make vcpu->mmu a pointer to the current MMU 2018-10-17 00:30:02 +02:00
mmutrace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mtrr.c KVM: x86: generalize guest_cpuid_has_ helpers 2017-08-07 16:11:50 +02:00
page_track.c treewide: kvzalloc() -> kvcalloc() 2018-06-12 16:19:22 -07:00
paging_tmpl.h x86/kvm/mmu: make vcpu->mmu a pointer to the current MMU 2018-10-17 00:30:02 +02:00
pmu.c KVM: x86: Add support for VMware backdoor Pseudo-PMCs 2018-03-16 22:02:01 +01:00
pmu.h KVM: x86: Add support for VMware backdoor Pseudo-PMCs 2018-03-16 22:02:01 +01:00
pmu_amd.c KVM: x86: Add support for AMD Core Perf Extension in guest 2018-03-16 22:01:28 +01:00
pmu_intel.c KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh() 2017-05-19 19:59:27 +02:00
svm.c kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb 2018-11-27 12:50:42 +01:00
trace.h KVM: x86: hyperv: implement PV IPI send hypercalls 2018-10-17 00:29:47 +02:00
tss.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
vmx.c KVM: Fix UAF in nested posted interrupt processing 2018-12-18 22:15:34 +01:00
vmx_evmcs.h x86/kvm: use Enlightened VMCS when running on Hyper-V 2018-03-28 22:47:06 +02:00
vmx_shadow_fields.h x86/kvm/nVMX: tweak shadow fields 2018-10-19 18:45:14 +02:00
x86.c KVM: X86: Fix NULL deref in vcpu_scan_ioapic 2018-12-18 22:15:44 +01:00
x86.h kvm: x86: Defer setting of CR2 until #PF delivery 2018-10-17 19:07:43 +02:00