From: bugzilla-daemon@bugzilla.kernel.org
To: kvm@vger.kernel.org
Subject: [Bug 103141] Host-triggerable NULL pointer oops
Date: Sun, 14 Jul 2019 18:09:47 +0000 [thread overview]
Message-ID: <bug-103141-28872-zi3T0EBmcx@https.bugzilla.kernel.org/> (raw)
In-Reply-To: <bug-103141-28872@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=103141
Alex Lyakas (alex@zadara.com) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |alex@zadara.com
--- Comment #4 from Alex Lyakas (alex@zadara.com) ---
We hit the same issue with kernel 3.18.19.
After some debugging, I see that the first test program that felix attached,
causes kvm_x86_ops->vcpu_create to return -EEXIST instead of a valid vcpu
pointer. As a result, the call to kvm_x86_ops->fpu_activate tries to access an
invalid pointer, and causes a NULL pointer dereference.
The suggested fix was delivered in kernel 4.2. Although it was tagged as
"stable", I don't see that it was backported to earlier kernels. I believe that
the fix addresses a different issue, in which the vcpu pointer is valid, but
further VMCS write has a problem (this is my understanding). But, of course,
this fix will address also the issue that felix reported. Although for the
latter, a simpler fix would suffice:
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7012,20 +7012,24 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
unsigned int id)
{
struct kvm_vcpu *vcpu;
if (check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
printk_once(KERN_WARNING
"kvm: SMP vm created on host with unstable TSC; "
"guest TSC will not be reliable\n");
vcpu = kvm_x86_ops->vcpu_create(kvm, id);
+ if (IS_ERR(vcpu)) {
+ pr_err("kvm_x86_ops->vcpu_create id=%u err=%ld\n", id,
PTR_ERR(vcpu));
+ return vcpu;
+ }
/*
* Activate fpu unconditionally in case the guest needs eager FPU. It
will be
* deactivated soon if it doesn't.
*/
kvm_x86_ops->fpu_activate(vcpu);
return vcpu;
}
--
You are receiving this mail because:
You are watching the assignee of the bug.
prev parent reply other threads:[~2019-07-14 18:09 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-19 16:42 [Bug 103141] New: Host-triggerable NULL pointer oops bugzilla-daemon
2015-08-19 22:48 ` [Bug 103141] " bugzilla-daemon
2015-08-24 15:46 ` bugzilla-daemon
2015-08-24 15:57 ` bugzilla-daemon
2019-07-14 18:09 ` bugzilla-daemon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-103141-28872-zi3T0EBmcx@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@bugzilla.kernel.org \
--cc=kvm@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).