kevin/linux
1
Fork 0
Code

A pretty straightforward fix for a NULL pointer dereference,

Browse Source 
plus the accompanying reproducer.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmYxL8UUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroNZWAf/TgdtQnrMRhiu/0z8S8gGx0CZwl0q
 bgEqqCLwtX7s9969nd4VH7JNldj1hA4stIZPJdJICpnAaShfJ0Mn9p39YxJsRHmQ
 mzCpLLHoe5vD7EmLNohFxkPk0SffgidudbLjjNxI7s9gqpU+yuu02odYqHxLZKJR
 Zu8LfciaW0lC1HgJBFMaFs00xEWgAar97eQL6VFGI3a8hAjDFaqHExJvzMZknXUO
 +66u12/xDVUFjNRfTHY45Jl1IS6zcsEe9gC4SanNZTl5FIBpJIQKyqdkhAzC1r4T
 /S3CeHZfZ/ZGI3oQV/8Sbu/aLgUMubAChhSHjpJVyHQOURT08emk+jY5tA==
 =I/xT
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fix from Paolo Bonzini:
 "A pretty straightforward fix for a NULL pointer dereference, plus the
  accompanying reproducer"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
  KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
This commit is contained in:
Linus Torvalds 2024-04-30 12:40:41 -07:00
commit 18daea77cc
2 changed files with 53 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
arch/arm64/kvm/vgic/vgic-kvm-device.c
View File

@ -338,12 +338,12 @@ int kvm_register_vgic_device(unsigned long type)
int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr,
struct vgic_reg_attr *reg_attr)
{
int cpuid;
int cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
reg_attr->addr = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK;
reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
if (!reg_attr->vcpu)
return -EINVAL;
return 0;
}

49
tools/testing/selftests/kvm/aarch64/vgic_init.c
View File

@ -84,6 +84,18 @@ static struct vm_gic vm_gic_create_with_vcpus(uint32_t gic_dev_type,
return v;
}
static struct vm_gic vm_gic_create_barebones(uint32_t gic_dev_type)
{
struct vm_gic v;
v.gic_dev_type = gic_dev_type;
v.vm = vm_create_barebones();
v.gic_fd = kvm_create_device(v.vm, gic_dev_type);
return v;
}
static void vm_gic_destroy(struct vm_gic *v)
{
close(v->gic_fd);
@ -357,6 +369,40 @@ static void test_vcpus_then_vgic(uint32_t gic_dev_type)
vm_gic_destroy(&v);
}
#define KVM_VGIC_V2_ATTR(offset, cpu) \
(FIELD_PREP(KVM_DEV_ARM_VGIC_OFFSET_MASK, offset) | \
FIELD_PREP(KVM_DEV_ARM_VGIC_CPUID_MASK, cpu))
#define GIC_CPU_CTRL 0x00
static void test_v2_uaccess_cpuif_no_vcpus(void)
{
struct vm_gic v;
u64 val = 0;
int ret;
v = vm_gic_create_barebones(KVM_DEV_TYPE_ARM_VGIC_V2);
subtest_dist_rdist(&v);
ret = __kvm_has_device_attr(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0));
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
ret = __kvm_device_attr_get(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
ret = __kvm_device_attr_set(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
TEST_ASSERT(ret && errno == EINVAL,
"accessed non-existent CPU interface, want errno: %i",
EINVAL);
vm_gic_destroy(&v);
}
static void test_v3_new_redist_regions(void)
{
struct kvm_vcpu *vcpus[NR_VCPUS];
@ -675,6 +721,9 @@ void run_tests(uint32_t gic_dev_type)
test_vcpus_then_vgic(gic_dev_type);
test_vgic_then_vcpus(gic_dev_type);
if (VGIC_DEV_IS_V2(gic_dev_type))
test_v2_uaccess_cpuif_no_vcpus();
if (VGIC_DEV_IS_V3(gic_dev_type)) {
test_v3_new_redist_regions();
test_v3_typer_accesses();