Commit d3329454 authored Mar 19, 2020 by Paolo Bonzini

KVM: x86: remove bogus user-triggerable WARN_ON

The WARN_ON is essentially comparing a user-provided value with 0. It is
trivial to trigger it just by passing garbage to KVM_SET_CLOCK. Guests
can break if you do so, but the same applies to every KVM_SET_* ioctl.
So, if it hurts when you do like this, just do not do it.

Reported-by: <syzbot+00be5da1d75f1cc95f6b@syzkaller.appspotmail.com>
Fixes: 9446e6fc ("KVM: x86: fix WARN_ON check of an unsigned less than zero")
Cc: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 018cabb6

arch/x86/kvm/x86.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -2444,7 +2444,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
		vcpu->hv_clock.tsc_timestamp = tsc_timestamp;
		vcpu->hv_clock.system_time = kernel_ns + v->kvm->arch.kvmclock_offset;
		vcpu->last_guest_tsc = tsc_timestamp;
		WARN_ON((s64)vcpu->hv_clock.system_time < 0);

		/* If the host uses TSC clocksource, then it is stable */
		pvclock_flags = 0;

Admin message