All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Subject: [PULL 1/7] i386: assert 'cs->kvm_state' is not null
Date: Thu, 29 Jul 2021 14:47:07 +0200	[thread overview]
Message-ID: <20210729124713.208422-2-pbonzini@redhat.com> (raw)
In-Reply-To: <20210729124713.208422-1-pbonzini@redhat.com>

From: Vitaly Kuznetsov <vkuznets@redhat.com>

Coverity reports potential NULL pointer dereference in
get_supported_hv_cpuid_legacy() when 'cs->kvm_state' is NULL. While
'cs->kvm_state' can indeed be NULL in hv_cpuid_get_host(),
kvm_hyperv_expand_features() makes sure that it only happens when
KVM_CAP_SYS_HYPERV_CPUID is supported and KVM_CAP_SYS_HYPERV_CPUID
implies KVM_CAP_HYPERV_CPUID so get_supported_hv_cpuid_legacy() is
never really called. Add asserts to strengthen the protection against
broken KVM behavior.

Coverity: CID 1458243
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210716115852.418293-1-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 59ed8327ac..e69abe48e3 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -974,6 +974,12 @@ static struct kvm_cpuid2 *get_supported_hv_cpuid(CPUState *cs)
     do_sys_ioctl =
         kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID) > 0;
 
+    /*
+     * Non-empty KVM context is needed when KVM_CAP_SYS_HYPERV_CPUID is
+     * unsupported, kvm_hyperv_expand_features() checks for that.
+     */
+    assert(do_sys_ioctl || cs->kvm_state);
+
     /*
      * When the buffer is too small, KVM_GET_SUPPORTED_HV_CPUID fails with
      * -E2BIG, however, it doesn't report back the right size. Keep increasing
@@ -1105,6 +1111,14 @@ static uint32_t hv_cpuid_get_host(CPUState *cs, uint32_t func, int reg)
         if (kvm_check_extension(kvm_state, KVM_CAP_HYPERV_CPUID) > 0) {
             cpuid = get_supported_hv_cpuid(cs);
         } else {
+            /*
+             * 'cs->kvm_state' may be NULL when Hyper-V features are expanded
+             * before KVM context is created but this is only done when
+             * KVM_CAP_SYS_HYPERV_CPUID is supported and it implies
+             * KVM_CAP_HYPERV_CPUID.
+             */
+            assert(cs->kvm_state);
+
             cpuid = get_supported_hv_cpuid_legacy(cs);
         }
         hv_cpuid_cache = cpuid;
-- 
2.31.1




  reply	other threads:[~2021-07-29 12:49 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-29 12:47 [PULL 0/7] Misc patches for QEMU 6.1-rc2 Paolo Bonzini
2021-07-29 12:47 ` Paolo Bonzini [this message]
2021-07-29 12:47 ` [PULL 2/7] Makefile: ignore long options Paolo Bonzini
2021-07-29 12:47 ` [PULL 3/7] configure: Add -Werror to avx2, avx512 tests Paolo Bonzini
2021-07-29 12:47 ` [PULL 4/7] target/i386: Added consistency checks for event injection Paolo Bonzini
2021-07-29 12:47 ` [PULL 5/7] target/i386: fix typo in ctl_has_irq Paolo Bonzini
2021-07-29 12:47 ` [PULL 6/7] meson: fix meson 0.58 warning with libvhost-user subproject Paolo Bonzini
2021-07-29 12:58   ` Peter Maydell
2021-07-29 14:05     ` Thomas Huth
2021-07-29 15:07       ` Peter Maydell
2021-07-29 16:50         ` 罗勇刚(Yonggang Luo)
2021-08-19  8:43   ` Christian Borntraeger
2021-08-19 14:51     ` Christian Borntraeger
2021-08-19 15:11       ` Christian Borntraeger
2021-07-29 12:47 ` [PULL 7/7] libvhost-user: fix -Werror=format= warnings with __u64 fields Paolo Bonzini
2021-07-29 17:48 ` [PULL 0/7] Misc patches for QEMU 6.1-rc2 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210729124713.208422-2-pbonzini@redhat.com \
    --to=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=vkuznets@redhat.com \
    --subject='Re: [PULL 1/7] i386: assert '\''cs->kvm_state'\'' is not null' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.