]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
authorJiakai Xu <xujiakai2025@iscas.ac.cn>
Sun, 17 May 2026 12:44:14 +0000 (12:44 +0000)
committerAnup Patel <anup@brainfault.org>
Mon, 18 May 2026 04:49:18 +0000 (10:19 +0530)
commitfdb69d401967fd88d27982a7e4984b2a3a4f0314
treec86e6cee54473319c6b0c74f01c0ebb32464c3a4
parent0e9d0e7a7c78db7aa1c13796c65cfe0aefa54a5b
RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler

The SBI v0.1 SEND_IPI handler iterates over the hart mask and calls
kvm_get_vcpu_by_id() to find the target vcpu for each set bit. When a
guest provides a hart mask containing bits for non-existent vcpu_ids,
kvm_get_vcpu_by_id() returns NULL, which is then unconditionally
dereferenced by kvm_riscv_vcpu_set_interrupt(), causing a kernel crash.

Fix this by adding a NULL check before dereferencing the return value.
If the target vcpu is not found, skip it and continue processing the
remaining valid harts.

Fixes: a046c2d8578c ("RISC-V: KVM: Reorganize SBI code by moving SBI v0.1 to its own file")
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Assisted-by: OpenClaw:DeepSeek-V3.2
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260517124414.420919-1-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
arch/riscv/kvm/vcpu_sbi_v01.c