[PW_SID:1100684] RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions#2014
[PW_SID:1100684] RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions#2014linux-riscv-bot wants to merge 1 commit into
Conversation
Fuzzer reported a NULL pointer dereference in kvm_riscv_vcpu_aia_imsic_put() when a VCPU's imsic_state was NULL while kvm_riscv_aia_initialized() returned true. The global initialized flag is set per-VM in aia_init(), but imsic_state is allocated per-VCPU in kvm_riscv_vcpu_aia_imsic_init(). If a VCPU is created after aia_init() has already run, its imsic_state remains NULL while the global flag is true. When this VCPU is preempted, kvm_sched_out() calls kvm_arch_vcpu_put() -> kvm_riscv_vcpu_aia_put() -> kvm_riscv_vcpu_aia_imsic_put() which dereferences NULL. Add NULL pointer guards to kvm_riscv_vcpu_aia_imsic_put(), consistent with the NULL checks already present in all other functions in the same file. Also add a NULL guard to kvm_riscv_vcpu_aia_imsic_release() and kvm_riscv_vcpu_aia_imsic_has_interrupt() for the same reason. Fixes: 4cec89d ("RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization") Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Assisted-by: YuanSheng:DeepSeek-V3.2 Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
|
Patch 1: "RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions" |
2 participants
PR for series 1100684 applied to workflow__riscv__fixes
Name: RISC-V: KVM: Fix NULL pointer dereference in AIA IMSIC functions
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1100684
Version: 1