linux/arch/x86
Wanpeng Li dcbd3e49c2 KVM: X86: Fix NULL deref in vcpu_scan_ioapic
Reported by syzkaller:

    CPU: 1 PID: 5962 Comm: syz-executor118 Not tainted 4.20.0-rc6+ #374
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:kvm_apic_hw_enabled arch/x86/kvm/lapic.h:169 [inline]
    RIP: 0010:vcpu_scan_ioapic arch/x86/kvm/x86.c:7449 [inline]
    RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:7602 [inline]
    RIP: 0010:vcpu_run arch/x86/kvm/x86.c:7874 [inline]
    RIP: 0010:kvm_arch_vcpu_ioctl_run+0x5296/0x7320 arch/x86/kvm/x86.c:8074
    Call Trace:
	 kvm_vcpu_ioctl+0x5c8/0x1150 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2596
	 vfs_ioctl fs/ioctl.c:46 [inline]
	 file_ioctl fs/ioctl.c:509 [inline]
	 do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696
	 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713
	 __do_sys_ioctl fs/ioctl.c:720 [inline]
	 __se_sys_ioctl fs/ioctl.c:718 [inline]
	 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
	 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT14 msr
and triggers scan ioapic logic to load synic vectors into EOI exit bitmap.
However, irqchip is not initialized by this simple testcase, ioapic/apic
objects should not be accessed.

This patch fixes it by also considering whether or not apic is present.

Reported-by: syzbot+39810e6c400efadfef71@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-12-18 22:15:44 +01:00
..
boot Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-12-09 14:03:56 -08:00
configs x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y 2018-10-10 08:29:51 +02:00
crypto crypto: x86/aes-ni - fix build error following fpu template removal 2018-10-08 13:47:02 +08:00
entry Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-12-09 15:09:55 -08:00
events perf/x86/intel: Disallow precise_ip on BTS events 2018-11-22 09:45:10 +01:00
hyperv Merge branch 'x86-paravirt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-10-23 17:54:58 +01:00
ia32
include x86/boot: Clear RSDP address in boot_params for broken loaders 2018-12-03 11:56:37 +01:00
kernel kprobes/x86: Fix instruction patching corruption when copying more than one RIP-relative instruction 2018-12-04 09:35:20 +01:00
kvm KVM: X86: Fix NULL deref in vcpu_scan_ioapic 2018-12-18 22:15:44 +01:00
lib Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-10-23 15:24:22 +01:00
math-emu
mm x86/speculation: Prepare for conditional IBPB in switch_mm() 2018-11-28 11:57:11 +01:00
net
oprofile
pci mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
platform x86/earlyprintk/efi: Fix infinite loop on some screen widths 2018-11-30 09:05:13 +01:00
power mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
purgatory
ras
realmode
tools x86: Clean up 'sizeof x' => 'sizeof(x)' 2018-10-29 07:13:28 +01:00
um Merge branch 'core/urgent' into x86/urgent, to pick up objtool fix 2018-11-03 23:42:16 +01:00
video
xen xen: fixes for 4.20-rc5 2018-12-02 12:15:55 -08:00
.gitignore
Kbuild
Kconfig x86/Kconfig: Select SCHED_SMT if SMP enabled 2018-11-28 11:57:07 +01:00
Kconfig.cpu x86/cpu: Create Hygon Dhyana architecture support file 2018-09-27 16:14:05 +02:00
Kconfig.debug x86/kconfig: Remove redundant 'default n' lines from all x86 Kconfig's 2018-10-17 08:39:42 +02:00
Makefile x86/build: Fix compiler support check for CONFIG_RETPOLINE 2018-12-05 08:44:02 +01:00
Makefile_32.cpu
Makefile.um