[PATCH] KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()

[PATCH] KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()

[黄乐]

In vcpu_load_eoi_exitmap(), currently the eoi_exit_bitmap[4] array is
initialized only when Hyper-V context is available, in other path it is
just passed to kvm_x86_ops.load_eoi_exitmap() directly from on the stack,
which would cause unexpected interrupt delivery/handling issues, e.g. an
*old* linux kernel that relies on PIT to do clock calibration on KVM might
randomly fail to boot.

Fix it by passing ioapic_handled_vectors to load_eoi_exitmap() when Hyper-V
context is not available.

Signed-off-by: Huang Le <huangle1@jd.com>
---
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index dc7eb5fddfd3..0699832504c9 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9547,11 +9547,14 @@ static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu)
 	if (!kvm_apic_hw_enabled(vcpu->arch.apic))
 		return;
 
-	if (to_hv_vcpu(vcpu))
-		bitmap_or((ulong *)eoi_exit_bitmap,
-			  vcpu->arch.ioapic_handled_vectors,
-			  to_hv_synic(vcpu)->vec_bitmap, 256);
+	if (!to_hv_vcpu(vcpu)) {
+		static_call(kvm_x86_load_eoi_exitmap)(
+			vcpu, (u64 *)vcpu->arch.ioapic_handled_vectors);
+		return;
+	}
 
+	bitmap_or((ulong *)eoi_exit_bitmap, vcpu->arch.ioapic_handled_vectors,
+		  to_hv_synic(vcpu)->vec_bitmap, 256);
 	static_call(kvm_x86_load_eoi_exitmap)(vcpu, eoi_exit_bitmap);
 }
 

Re: [PATCH] KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()

[Vitaly Kuznetsov]

黄乐 <huangle1@jd.com> writes:

> In vcpu_load_eoi_exitmap(), currently the eoi_exit_bitmap[4] array is
> initialized only when Hyper-V context is available, in other path it is
> just passed to kvm_x86_ops.load_eoi_exitmap() directly from on the stack,
> which would cause unexpected interrupt delivery/handling issues, e.g. an
> *old* linux kernel that relies on PIT to do clock calibration on KVM might
> randomly fail to boot.
>
> Fix it by passing ioapic_handled_vectors to load_eoi_exitmap() when Hyper-V
> context is not available.
>
> Signed-off-by: Huang Le <huangle1@jd.com>

Fixes: f2bc14b69c38 ("KVM: x86: hyper-v: Prepare to meet unallocated Hyper-V context")
Cc: stable@vger.kernel.org

> ---
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index dc7eb5fddfd3..0699832504c9 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9547,11 +9547,14 @@ static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu)
>  	if (!kvm_apic_hw_enabled(vcpu->arch.apic))
>  		return;
>  
> -	if (to_hv_vcpu(vcpu))
> -		bitmap_or((ulong *)eoi_exit_bitmap,
> -			  vcpu->arch.ioapic_handled_vectors,
> -			  to_hv_synic(vcpu)->vec_bitmap, 256);
> +	if (!to_hv_vcpu(vcpu)) {
> +		static_call(kvm_x86_load_eoi_exitmap)(
> +			vcpu, (u64 *)vcpu->arch.ioapic_handled_vectors);
> +		return;
> +	}
>  
> +	bitmap_or((ulong *)eoi_exit_bitmap, vcpu->arch.ioapic_handled_vectors,
> +		  to_hv_synic(vcpu)->vec_bitmap, 256);
>  	static_call(kvm_x86_load_eoi_exitmap)(vcpu, eoi_exit_bitmap);
>  }
>  

Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>

My personal preference, however, would be to keep 'if
(to_hv_vcpu(vcpu))' check and not invert it, i.e.:

	if (to_hv_vcpu(vcpu)) {
		bitmap_or((ulong *)eoi_exit_bitmap,
                	vcpu->arch.ioapic_handled_vectors,
                	to_hv_synic(vcpu)->vec_bitmap, 256);
                static_call(...)(vcpu, eoi_exit_bitmap)
                return;
        }

	static_call(...)(vcpu, (u64 *)vcpu->arch.ioapic_handled_vectors);

to slightly reduce the code churn but it doesn't matter much.

Thanks!

-- 
Vitaly