Re: [PATCH] KVM: x86: Fix potential NULL dereference in amd_pmu_refresh()

[Sean Christopherson <seanjc@google.com>]

On Tue, Nov 25, 2025, Chelsy Ratnawat wrote:
> kvm_find_cpuid_entry_index() can return NULL if the guest CPUID
> entry is missing, but amd_pmu_refresh() was dereferencing the pointer
> without checking. This could cause a kernel crash.
> 
> Add a NULL check and fallback to AMD64_NUM_COUNTERS_CORE if the
> entry is missing.
> 
> Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
> ---
>  arch/x86/kvm/svm/pmu.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c
> index bc062285fbf5..aa8313fa98c9 100644
> --- a/arch/x86/kvm/svm/pmu.c
> +++ b/arch/x86/kvm/svm/pmu.c
> @@ -178,6 +178,7 @@ static void amd_pmu_refresh(struct kvm_vcpu *vcpu)
>  {
>  	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
>  	union cpuid_0x80000022_ebx ebx;
> +	struct kvm_cpuid_entry2 *entry;
>  
>  	pmu->version = 1;
>  	if (guest_cpu_cap_has(vcpu, X86_FEATURE_PERFMON_V2)) {
> @@ -188,8 +189,13 @@ static void amd_pmu_refresh(struct kvm_vcpu *vcpu)
>  		 */
>  		BUILD_BUG_ON(x86_feature_cpuid(X86_FEATURE_PERFMON_V2).function != 0x80000022 ||
>  			     x86_feature_cpuid(X86_FEATURE_PERFMON_V2).index);
> -		ebx.full = kvm_find_cpuid_entry_index(vcpu, 0x80000022, 0)->ebx;

Heh, me thinks you didn't read the comment above the BUILD_BUG_ON():

		/*
		 * Note, PERFMON_V2 is also in 0x80000022.0x0, i.e. the guest
		 * CPUID entry is guaranteed to be non-NULL.
		 */
		BUILD_BUG_ON(x86_feature_cpuid(X86_FEATURE_PERFMON_V2).function != 0x80000022 ||
			     x86_feature_cpuid(X86_FEATURE_PERFMON_V2).index);

Yes, it's weird and confusing to subtly rely on entry 0x80000022 being non-NULL,
but doing so means KVM doesn't have to provide arbitrary fallback logic for a
scenario that can't happen.