Commit b904cb8d authored Apr 25, 2019 by Sean Christopherson Committed by Paolo Bonzini Apr 30, 2019

KVM: lapic: Check for in-kernel LAPIC before deferencing apic pointer



...to avoid dereferencing a null pointer when querying the per-vCPU
timer advance.

Fixes: 39497d76 ("KVM: lapic: Track lapic timer advance per vCPU")
Reported-by:  <syzbot+f7e65445a40d3e0e4ebf@syzkaller.appspotmail.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 76d58e0f

arch/x86/kvm/lapic.c

+0 −3

Original line number	Diff line number	Diff line
		@@ -1507,9 +1507,6 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu)
		u32 timer_advance_ns = apic->lapic_timer.timer_advance_ns;
		u64 guest_tsc, tsc_deadline, ns;

		if (!lapic_in_kernel(vcpu))
		return;

		if (apic->lapic_timer.expired_tscdeadline == 0)
		return;

arch/x86/kvm/x86.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -7894,7 +7894,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
		}

		trace_kvm_entry(vcpu->vcpu_id);
		if (vcpu->arch.apic->lapic_timer.timer_advance_ns)
		if (lapic_in_kernel(vcpu) &&
		vcpu->arch.apic->lapic_timer.timer_advance_ns)
		wait_lapic_expire(vcpu);
		guest_enter_irqoff();