[Bug,103141] Host-triggerable NULL pointer oops
diff mbox series

Message ID bug-103141-28872-zi3T0EBmcx@https.bugzilla.kernel.org/
State New
Headers show
  • [Bug,103141] Host-triggerable NULL pointer oops
Related show

Commit Message

bugzilla-daemon@bugzilla.kernel.org July 14, 2019, 6:09 p.m. UTC

Alex Lyakas (alex@zadara.com) changed:

           What    |Removed                     |Added
                 CC|                            |alex@zadara.com

--- Comment #4 from Alex Lyakas (alex@zadara.com) ---
We hit the same issue with kernel 3.18.19.

After some debugging, I see that the first test program that felix attached,
causes kvm_x86_ops->vcpu_create to return -EEXIST instead of a valid vcpu
pointer. As a result, the call to kvm_x86_ops->fpu_activate tries to access an
invalid pointer, and causes a NULL pointer dereference.

The suggested fix was delivered in kernel 4.2. Although it was tagged as
"stable", I don't see that it was backported to earlier kernels. I believe that
the fix addresses a different issue, in which the vcpu pointer is valid, but
further VMCS write has a problem (this is my understanding). But, of course,
this fix will address also the issue that felix reported. Although for the
latter, a simpler fix would suffice:

diff mbox series

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7012,20 +7012,24 @@  struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
                                                unsigned int id)
        struct kvm_vcpu *vcpu;

        if (check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
                "kvm: SMP vm created on host with unstable TSC; "
                "guest TSC will not be reliable\n");

        vcpu = kvm_x86_ops->vcpu_create(kvm, id);
+       if (IS_ERR(vcpu)) {
+               pr_err("kvm_x86_ops->vcpu_create id=%u err=%ld\n", id,
+               return vcpu;
+       }

         * Activate fpu unconditionally in case the guest needs eager FPU.  It
will be
         * deactivated soon if it doesn't.
        return vcpu;