Commit b904cb8d authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: lapic: Check for in-kernel LAPIC before deferencing apic pointer 



...to avoid dereferencing a null pointer when querying the per-vCPU
timer advance.

Fixes: 39497d76 ("KVM: lapic: Track lapic timer advance per vCPU")
Reported-by: default avatar <syzbot+f7e65445a40d3e0e4ebf@syzkaller.appspotmail.com>
Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Reviewed-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 76d58e0f

arch/x86/kvm/lapic.c

+0 −3
Original line number Original line Diff line number Diff line
@@ -1507,9 +1507,6 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu) 
	u32 timer_advance_ns = apic->lapic_timer.timer_advance_ns;

	u32 timer_advance_ns = apic->lapic_timer.timer_advance_ns;

	u64 guest_tsc, tsc_deadline, ns;

	u64 guest_tsc, tsc_deadline, ns;





	if (!lapic_in_kernel(vcpu))

		return;



	if (apic->lapic_timer.expired_tscdeadline == 0)

	if (apic->lapic_timer.expired_tscdeadline == 0)

		return;

		return;

arch/x86/kvm/x86.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -7894,7 +7894,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) 
	}

	}





	trace_kvm_entry(vcpu->vcpu_id);

	trace_kvm_entry(vcpu->vcpu_id);

	if (vcpu->arch.apic->lapic_timer.timer_advance_ns)

	if (lapic_in_kernel(vcpu) &&

	    vcpu->arch.apic->lapic_timer.timer_advance_ns)

		wait_lapic_expire(vcpu);

		wait_lapic_expire(vcpu);

	guest_enter_irqoff();

	guest_enter_irqoff();

CRA Git | Maintained and supported by SUSTech CRA and CCSE