Skip to content

Commit 8dd471b

Browse files
tianhuasacrnsi
authored andcommitted
hv: fix possible null pointer dereference
This patch fix potential null pointer dereference 1, will access null pointer if 'context' is null. 2, if entry already been added to the VM when add intx entry for this vm, but parameter virt_pin is not equal to entry->virt_sid.intx_id.pin. So will saves this entry address to vpin_to_pt_entry[entry->virt_sid.intx_id.pin] and vpin_to_pt_entry[virt_pin]. In this case, this entry will be freed twice. Tracked-On: #3217 Signed-off-by: Tianhua Sun <tianhuax.s.sun@intel.com> Acked-by: Eddie Dong <eddie.dong@intel.com>
1 parent 509af78 commit 8dd471b

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

hypervisor/arch/x86/guest/assign.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,7 @@ static struct ptirq_remapping_info *add_intx_remapping(struct acrn_vm *vm, uint3
358358
uint32_t phys_pin, bool pic_pin)
359359
{
360360
struct ptirq_remapping_info *entry = NULL;
361+
bool entry_is_updated = true;
361362
uint32_t vpin_src = pic_pin ? PTDEV_VPIN_PIC : PTDEV_VPIN_IOAPIC;
362363
DEFINE_IOAPIC_SID(phys_sid, phys_pin, 0U);
363364
DEFINE_IOAPIC_SID(virt_sid, virt_pin, vpin_src);
@@ -398,9 +399,10 @@ static struct ptirq_remapping_info *add_intx_remapping(struct acrn_vm *vm, uint3
398399
} else {
399400
/* The mapping has already been added to the VM. No action
400401
* required. */
402+
entry_is_updated = false;
401403
}
402404

403-
if (entry != NULL) {
405+
if (entry != NULL && entry_is_updated) {
404406
if (pic_pin) {
405407
vm->arch_vm.vpic.vpin_to_pt_entry[virt_pin] = entry;
406408
} else {

hypervisor/arch/x86/vtd.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1182,7 +1182,7 @@ static int32_t remove_iommu_device(const struct iommu_domain *domain, uint16_t s
11821182

11831183
context_entry = context + devfun;
11841184

1185-
if (context_entry == NULL) {
1185+
if (context == NULL || context_entry == NULL) {
11861186
pr_err("dmar context entry is invalid");
11871187
ret = -EINVAL;
11881188
} else if ((uint16_t)dmar_get_bitslice(context_entry->hi_64, CTX_ENTRY_UPPER_DID_MASK, CTX_ENTRY_UPPER_DID_POS) != vmid_to_domainid(domain->vm_id)) {

0 commit comments

Comments
 (0)