• Wanpeng Li's avatar
    KVM: X86: Fix async pf caused null-ptr-deref · 9d3c447c
    Wanpeng Li authored
    Syzbot reported that:
    
      CPU: 1 PID: 6780 Comm: syz-executor153 Not tainted 5.7.0-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:__apic_accept_irq+0x46/0xb80
      Call Trace:
       kvm_arch_async_page_present+0x7de/0x9e0
       kvm_check_async_pf_completion+0x18d/0x400
       kvm_arch_vcpu_ioctl_run+0x18bf/0x69f0
       kvm_vcpu_ioctl+0x46a/0xe20
       ksys_ioctl+0x11a/0x180
       __x64_sys_ioctl+0x6f/0xb0
       do_syscall_64+0xf6/0x7d0
       entry_SYSCALL_64_after_hwframe+0x49/0xb3
    
    The testcase enables APF mechanism in MSR_KVM_ASYNC_PF_EN with ASYNC_PF_INT
    enabled w/o setting MSR_KVM_ASYNC_PF_INT before, what's worse, interrupt
    based APF 'page ready' event delivery depends on in kernel lapic, however,
    we didn't bail out when lapic is not in kernel during guest setting
    MSR_KVM_ASYNC_PF_EN which causes the null-ptr-deref in host later.
    This patch fixes it.
    
    Reported-by: syzbot+1bf777dfdde86d64b89b@syzkaller.appspotmail.com
    Fixes: 2635b5c4 (KVM: x86: interrupt based APF 'page ready' event delivery)
    Signed-off-by: default avatarWanpeng Li <wanpengli@tencent.com>
    Message-Id: <1593426391-8231-1-git-send-email-wanpengli@tencent.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    9d3c447c
x86.c 279 KB