Re: [PATCH 18/60] kvm: Move kvm_vcpu->rcuwait to struct kvm_vcpu_common

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Host kernel panic (NULL pointer dereference) triggered by MIPS out-of-bounds CPU ID in interrupt ioctl/MMIO.
--

commit 1db0b07fbf183499e26c76e72be724cdc1b067cc
Author: Joerg Roedel <joerg.roedel@amd.com>

kvm: Move kvm_vcpu->rcuwait to struct kvm_vcpu_common

This commit moves the rcuwait member from the architecture-specific
vcpu structure to the common kvm_vcpu_common struct. This ensures
there is only a single wait object shared across all plane VCPUs.

> diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
> index f928ba105104b..6469ec246dd60 100644
> --- a/arch/mips/kvm/mips.c
> +++ b/arch/mips/kvm/mips.c
[ ... ]
> @@ -507,7 +507,7 @@ int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
>  
>  	dvcpu->arch.wait = 0;
>  
> -	rcuwait_wake_up(&dvcpu->wait);

[Severity: High]
This is a pre-existing issue, but is there a missing NULL pointer check for
dvcpu before these operations?

Looking at kvm_vcpu_ioctl_interrupt() earlier in this function:

    if (irq->cpu == -1)
        dvcpu = vcpu;
    else
        dvcpu = kvm_get_vcpu(vcpu->kvm, irq->cpu);
        
If irq->cpu is out of bounds, kvm_get_vcpu() will return NULL. We then
unconditionally dereference dvcpu at dvcpu->arch.wait = 0 and pass it into
kvm_arch_vcpu_get_wait(), which could trigger a host kernel panic.

Additionally, if kvm_vcpu_ioctl_interrupt() is called with a NULL vcpu
argument (for example, from loongson_vipi_write() using kvm_get_vcpu(kvm, id)
with an out-of-bounds ID), it would also dereference NULL when evaluating
vcpu->kvm.

Should there be a check ensuring these pointers are valid before they are
dereferenced?

> +	rcuwait_wake_up(kvm_arch_vcpu_get_wait(dvcpu));
>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608144252.351443-1-joro@8bytes.org?part=18