Commit c23981df authored by Like Xu's avatar Like Xu Committed by Sean Christopherson
Browse files

KVM: x86/pmu: Avoid setting BIT_ULL(-1) to pmu->host_cross_mapped_mask 



In the extreme case of host counters multiplexing and contention, the
perf_event requested by the guest's pebs counter is not allocated to any
actual physical counter, in which case hw.idx is bookkept as -1,
resulting in an out-of-bounds access to host_cross_mapped_mask.

Fixes: 85425032 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations")
Signed-off-by: default avatarLike Xu <likexu@tencent.com>
Link: https://lore.kernel.org/r/20220831085328.45489-2-likexu@tencent.com


[sean: expand comment to explain how a negative idx can be encountered]
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent 31d3b871

arch/x86/kvm/vmx/pmu_intel.c

+9 −6
Original line number Diff line number Diff line
@@ -776,20 +776,23 @@ static void intel_pmu_cleanup(struct kvm_vcpu *vcpu) 
void intel_pmu_cross_mapped_check(struct kvm_pmu *pmu)

{

	struct kvm_pmc *pmc = NULL;

	int bit;

	int bit, hw_idx;



	for_each_set_bit(bit, (unsigned long *)&pmu->global_ctrl,

			 X86_PMC_IDX_MAX) {

		pmc = intel_pmc_idx_to_pmc(pmu, bit);



		if (!pmc || !pmc_speculative_in_use(pmc) ||

		    !intel_pmc_is_enabled(pmc))

		    !intel_pmc_is_enabled(pmc) || !pmc->perf_event)

			continue;



		if (pmc->perf_event && pmc->idx != pmc->perf_event->hw.idx) {

			pmu->host_cross_mapped_mask |=

				BIT_ULL(pmc->perf_event->hw.idx);

		}

		/*

		 * A negative index indicates the event isn't mapped to a

		 * physical counter in the host, e.g. due to contention.

		 */

		hw_idx = pmc->perf_event->hw.idx;

		if (hw_idx != pmc->idx && hw_idx > -1)

			pmu->host_cross_mapped_mask |= BIT_ULL(hw_idx);

	}

}