From: xuanqingshi <1356292400@qq.com> Date: Fri, 6 Mar 2026 09:12:32 +0000 (+0800) Subject: KVM: x86: Add LAPIC guard in kvm_apic_write_nodecode() X-Git-Tag: v7.1-rc1~118^2~9^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=26c9bfc0fac240540581cfbe58031b412f98aaf8;p=thirdparty%2Fkernel%2Flinux.git KVM: x86: Add LAPIC guard in kvm_apic_write_nodecode() kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first checking whether the in-kernel LAPIC has been initialized. If it has not (e.g. the vCPU was created without an in-kernel LAPIC), the dereference results in a NULL pointer access. While APIC-write VM-Exits are not expected to occur on a vCPU without an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against such a scenario as a defense-in-depth measure, e.g. to guard against KVM bugs or CPU errata that could generate a spurious APIC-write VM-Exit. Use KVM_BUG_ON() with lapic_in_kernel() instead of a simple WARN_ON_ONCE(), as suggested by Sean Christopherson, so that KVM kills the VM outright rather than letting it continue in a broken state. Found by a VMCS-targeted fuzzer based on syzkaller. Signed-off-by: xuanqingshi <1356292400@qq.com> Link: https://patch.msgid.link/tencent_7A9F1B4D75468C0CF5DE1B6902038C948B07@qq.com Signed-off-by: Sean Christopherson --- diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 9381c58d4c85c..02f2039d5f99d 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2657,6 +2657,9 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) { struct kvm_lapic *apic = vcpu->arch.apic; + if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return; + /* * ICR is a single 64-bit register when x2APIC is enabled, all others * registers hold 32-bit values. For legacy xAPIC, ICR writes need to