[PATCH] KVM: VMX: hyper-v: Prevent impossible NULL pointer dereference in evmcs_load()

[PATCH] KVM: VMX: hyper-v: Prevent impossible NULL pointer dereference in evmcs_load()

[Vitaly Kuznetsov]

GCC 12.3.0 complains about a potential NULL pointer dereference in
evmcs_load() as hv_get_vp_assist_page() can return NULL. In fact, this
cannot happen because KVM verifies (hv_init_evmcs()) that every CPU has a
valid VP assist page and aborts enabling the feature otherwise. CPU
onlining path is also checked in vmx_hardware_enable().

To make the compiler happy and to future proof the code, add a KVM_BUG_ON()
sentinel. It doesn't seem to be possible (and logical) to observe
evmcs_load() happening without an active vCPU so it is presumed that
kvm_get_running_vcpu() can't return NULL.

No functional change intended.

Reported-by: Mirsad Todorovac <mtodorovac69@gmail.com>
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/kvm/vmx/vmx_onhyperv.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx_onhyperv.h b/arch/x86/kvm/vmx/vmx_onhyperv.h
index eb48153bfd73..bba24ed99ee6 100644
--- a/arch/x86/kvm/vmx/vmx_onhyperv.h
+++ b/arch/x86/kvm/vmx/vmx_onhyperv.h
@@ -104,6 +104,14 @@ static inline void evmcs_load(u64 phys_addr)
 	struct hv_vp_assist_page *vp_ap =
 		hv_get_vp_assist_page(smp_processor_id());
 
+	/*
+	 * When enabling eVMCS, KVM verifies that every CPU has a valid hv_vp_assist_page()
+	 * and aborts enabling the feature otherwise. CPU onlining path is also checked in
+	 * vmx_hardware_enable().
+	 */
+	if (KVM_BUG_ON(!vp_ap, kvm_get_running_vcpu()->kvm))
+		return;
+
 	if (current_evmcs->hv_enlightenments_control.nested_flush_hypercall)
 		vp_ap->nested_control.features.directhypercall = 1;
 	vp_ap->current_nested_vmcs = phys_addr;
-- 
2.46.0

Re: [PATCH] KVM: VMX: hyper-v: Prevent impossible NULL pointer dereference in evmcs_load()

[Sean Christopherson]

On Fri, 16 Aug 2024 15:01:24 +0200, Vitaly Kuznetsov wrote:
> GCC 12.3.0 complains about a potential NULL pointer dereference in
> evmcs_load() as hv_get_vp_assist_page() can return NULL. In fact, this
> cannot happen because KVM verifies (hv_init_evmcs()) that every CPU has a
> valid VP assist page and aborts enabling the feature otherwise. CPU
> onlining path is also checked in vmx_hardware_enable().
> 
> To make the compiler happy and to future proof the code, add a KVM_BUG_ON()
> sentinel. It doesn't seem to be possible (and logical) to observe
> evmcs_load() happening without an active vCPU so it is presumed that
> kvm_get_running_vcpu() can't return NULL.
> 
> [...]

Applied to kvm-x86 vmx, thanks!

[1/1] KVM: VMX: hyper-v: Prevent impossible NULL pointer dereference in evmcs_load()
      https://github.com/kvm-x86/linux/commit/2ab637df5f68

--
https://github.com/kvm-x86/linux/tree/next