diff options
| author | xuanqingshi <1356292400@qq.com> | 2026-03-06 12:12:32 +0300 |
|---|---|---|
| committer | Sean Christopherson <seanjc@google.com> | 2026-03-12 19:11:40 +0300 |
| commit | 26c9bfc0fac240540581cfbe58031b412f98aaf8 (patch) | |
| tree | 579e9eeef21df7fa021551ca4ddf3deede484ed7 | |
| parent | d216449f253c7039c3e6a0276279c117a5198ce0 (diff) | |
| download | linux-26c9bfc0fac240540581cfbe58031b412f98aaf8.tar.xz | |
KVM: x86: Add LAPIC guard in kvm_apic_write_nodecode()
kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first
checking whether the in-kernel LAPIC has been initialized. If it has
not (e.g. the vCPU was created without an in-kernel LAPIC), the
dereference results in a NULL pointer access.
While APIC-write VM-Exits are not expected to occur on a vCPU without
an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against
such a scenario as a defense-in-depth measure, e.g. to guard against
KVM bugs or CPU errata that could generate a spurious APIC-write
VM-Exit.
Use KVM_BUG_ON() with lapic_in_kernel() instead of a simple
WARN_ON_ONCE(), as suggested by Sean Christopherson, so that KVM
kills the VM outright rather than letting it continue in a broken
state.
Found by a VMCS-targeted fuzzer based on syzkaller.
Signed-off-by: xuanqingshi <1356292400@qq.com>
Link: https://patch.msgid.link/tencent_7A9F1B4D75468C0CF5DE1B6902038C948B07@qq.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
| -rw-r--r-- | arch/x86/kvm/lapic.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 9381c58d4c85..02f2039d5f99 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2657,6 +2657,9 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) { struct kvm_lapic *apic = vcpu->arch.apic; + if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return; + /* * ICR is a single 64-bit register when x2APIC is enabled, all others * registers hold 32-bit values. For legacy xAPIC, ICR writes need to |