git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From foo@baz Mon Aug 15 02:54:39 PM CEST 2022
   2 From: Stefan Ghinea <stefan.ghinea@windriver.com>
   3 Date: Wed, 10 Aug 2022 23:26:55 +0300
   4 Subject: KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
   5 To: stable@vger.kernel.org
   6 Cc: Vitaly Kuznetsov <vkuznets@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Stefan Ghinea <stefan.ghinea@windriver.com>
   7 Message-ID: <20220810202655.32600-3-stefan.ghinea@windriver.com>
   8
   9 From: Vitaly Kuznetsov <vkuznets@redhat.com>
  10
  11 commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream
  12
  13 When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF
  14 shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON()
  15 instead of crashing the host.
  16
  17 Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
  18 Message-Id: <20220325132140.25650-3-vkuznets@redhat.com>
  19 Cc: stable@vger.kernel.org
  20 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  21 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23 ---
  24  arch/x86/kvm/lapic.c |    4 ++++
  25  1 file changed, 4 insertions(+)
  26
  27 --- a/arch/x86/kvm/lapic.c
  28 +++ b/arch/x86/kvm/lapic.c
  29 @@ -894,6 +894,10 @@ bool kvm_irq_delivery_to_apic_fast(struc
  30         *r = -1;
  31
  32         if (irq->shorthand == APIC_DEST_SELF) {
  33 +               if (KVM_BUG_ON(!src, kvm)) {
  34 +                       *r = 0;
  35 +                       return true;
  36 +               }
  37                 *r = kvm_apic_set_irq(src->vcpu, irq, dest_map);
  38                 return true;
  39         }