Re: [Qemu-devel] [PATCH] kvm: check dev parameter when updating msi route

Re: [Qemu-devel] [PATCH] kvm: check dev parameter when updating msi route

[Radim Krčmář]

This should primarily go to the qemu devel list.  I've Cc'd it, but
reposting would be safer, thanks.


2018-02-02 10:21+0530, P J P:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> When updating message signalled interrupt(MSI) route in routine
> kvm_irqchip_update_msi_route, device parameter could be null.
> Add check to avoid null dereference.
> 
> Reported-by: Guoxiang Niu <niuguoxiang@huawei.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  accel/kvm/kvm-all.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> index f290f487a5..cb7613d282 100644
> --- a/accel/kvm/kvm-all.c
> +++ b/accel/kvm/kvm-all.c
> @@ -1167,7 +1167,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
>      kroute.u.msi.address_lo = (uint32_t)msg.address;
>      kroute.u.msi.address_hi = msg.address >> 32;
>      kroute.u.msi.data = le32_to_cpu(msg.data);
> -    if (pci_available && kvm_msi_devid_required()) {
> +    if (pci_available && dev && kvm_msi_devid_required()) {
>          kroute.flags = KVM_MSI_VALID_DEVID;
>          kroute.u.msi.devid = pci_requester_id(dev);
>      }
> @@ -1205,7 +1205,7 @@ int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
>      kroute.u.msi.address_lo = (uint32_t)msg.address;
>      kroute.u.msi.address_hi = msg.address >> 32;
>      kroute.u.msi.data = le32_to_cpu(msg.data);
> -    if (pci_available && kvm_msi_devid_required()) {
> +    if (pci_available && dev && kvm_msi_devid_required()) {
>          kroute.flags = KVM_MSI_VALID_DEVID;
>          kroute.u.msi.devid = pci_requester_id(dev);
>      }
> -- 
> 2.14.3
> 

Re: [Qemu-devel] [PATCH] kvm: check dev parameter when updating msi route

[P J P]

  Hello Radim,

+-- On Fri, 2 Feb 2018, Radim Krčmář wrote --+
| This should primarily go to the qemu devel list.  I've Cc'd it, but
| reposting would be safer, thanks.

  Ah, Okay. I did think qemu-devel would be better, but MAINTAINERS file lists 
kvm@vger.kernel.org address for accel/kvm/.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

[Qemu-devel] [PATCH] kvm: check dev parameter when updating msi route

[P J P]

From: Prasad J Pandit <pjp@fedoraproject.org>

When updating message signalled interrupt(MSI) route in routine
kvm_irqchip_update_msi_route, device parameter could be null.
Add check to avoid null dereference.

Reported-by: Guoxiang Niu <niuguoxiang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 accel/kvm/kvm-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f290f487a5..cb7613d282 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1167,7 +1167,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
     kroute.u.msi.address_lo = (uint32_t)msg.address;
     kroute.u.msi.address_hi = msg.address >> 32;
     kroute.u.msi.data = le32_to_cpu(msg.data);
-    if (pci_available && kvm_msi_devid_required()) {
+    if (pci_available && dev && kvm_msi_devid_required()) {
         kroute.flags = KVM_MSI_VALID_DEVID;
         kroute.u.msi.devid = pci_requester_id(dev);
     }
@@ -1205,7 +1205,7 @@ int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
     kroute.u.msi.address_lo = (uint32_t)msg.address;
     kroute.u.msi.address_hi = msg.address >> 32;
     kroute.u.msi.data = le32_to_cpu(msg.data);
-    if (pci_available && kvm_msi_devid_required()) {
+    if (pci_available && dev && kvm_msi_devid_required()) {
         kroute.flags = KVM_MSI_VALID_DEVID;
         kroute.u.msi.devid = pci_requester_id(dev);
     }
-- 
2.14.3

Re: [Qemu-devel] [PATCH] kvm: check dev parameter when updating msi route

[Paolo Bonzini]

On 05/02/2018 07:18, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> When updating message signalled interrupt(MSI) route in routine
> kvm_irqchip_update_msi_route, device parameter could be null.
> Add check to avoid null dereference.
> 
> Reported-by: Guoxiang Niu <niuguoxiang@huawei.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Please include the full backtrace.  On a machine that needs
KVM_MSI_VALID_DEVID, it should not be possible to associate MSIs with
non-PCI devices (dev should only be NULL for x86 with "-machine
kernel_irqchip=split", and x86 does not need KVM_MSI_VALID_DEVID).

Paolo

> ---
>  accel/kvm/kvm-all.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> index f290f487a5..cb7613d282 100644
> --- a/accel/kvm/kvm-all.c
> +++ b/accel/kvm/kvm-all.c
> @@ -1167,7 +1167,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
>      kroute.u.msi.address_lo = (uint32_t)msg.address;
>      kroute.u.msi.address_hi = msg.address >> 32;
>      kroute.u.msi.data = le32_to_cpu(msg.data);
> -    if (pci_available && kvm_msi_devid_required()) {
> +    if (pci_available && dev && kvm_msi_devid_required()) {
>          kroute.flags = KVM_MSI_VALID_DEVID;
>          kroute.u.msi.devid = pci_requester_id(dev);
>      }
> @@ -1205,7 +1205,7 @@ int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
>      kroute.u.msi.address_lo = (uint32_t)msg.address;
>      kroute.u.msi.address_hi = msg.address >> 32;
>      kroute.u.msi.data = le32_to_cpu(msg.data);
> -    if (pci_available && kvm_msi_devid_required()) {
> +    if (pci_available && dev && kvm_msi_devid_required()) {
>          kroute.flags = KVM_MSI_VALID_DEVID;
>          kroute.u.msi.devid = pci_requester_id(dev);
>      }
>