diff options
| author | Vitaly Kuznetsov <vkuznets@redhat.com> | 2021-07-16 13:58:51 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-07-29 10:15:51 +0200 |
| commit | e4adb09f7952fd37b7f1ba3df377d54d0823e682 (patch) | |
| tree | 19e69d6fa6862c9f384ae482b6b216250c524299 | |
| parent | 69ea12b19a15ae006521cd5cc0f627f27f738746 (diff) | |
| download | qemu-e4adb09f7952fd37b7f1ba3df377d54d0823e682.zip qemu-e4adb09f7952fd37b7f1ba3df377d54d0823e682.tar.gz qemu-e4adb09f7952fd37b7f1ba3df377d54d0823e682.tar.bz2 | |
i386: assert 'cs->kvm_state' is not null
Coverity reports potential NULL pointer dereference in
get_supported_hv_cpuid_legacy() when 'cs->kvm_state' is NULL. While
'cs->kvm_state' can indeed be NULL in hv_cpuid_get_host(),
kvm_hyperv_expand_features() makes sure that it only happens when
KVM_CAP_SYS_HYPERV_CPUID is supported and KVM_CAP_SYS_HYPERV_CPUID
implies KVM_CAP_HYPERV_CPUID so get_supported_hv_cpuid_legacy() is
never really called. Add asserts to strengthen the protection against
broken KVM behavior.
Coverity: CID 1458243
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210716115852.418293-1-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/kvm/kvm.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index 59ed832..e69abe4 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -975,6 +975,12 @@ static struct kvm_cpuid2 *get_supported_hv_cpuid(CPUState *cs) kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID) > 0; /* + * Non-empty KVM context is needed when KVM_CAP_SYS_HYPERV_CPUID is + * unsupported, kvm_hyperv_expand_features() checks for that. + */ + assert(do_sys_ioctl || cs->kvm_state); + + /* * When the buffer is too small, KVM_GET_SUPPORTED_HV_CPUID fails with * -E2BIG, however, it doesn't report back the right size. Keep increasing * it and re-trying until we succeed. @@ -1105,6 +1111,14 @@ static uint32_t hv_cpuid_get_host(CPUState *cs, uint32_t func, int reg) if (kvm_check_extension(kvm_state, KVM_CAP_HYPERV_CPUID) > 0) { cpuid = get_supported_hv_cpuid(cs); } else { + /* + * 'cs->kvm_state' may be NULL when Hyper-V features are expanded + * before KVM context is created but this is only done when + * KVM_CAP_SYS_HYPERV_CPUID is supported and it implies + * KVM_CAP_HYPERV_CPUID. + */ + assert(cs->kvm_state); + cpuid = get_supported_hv_cpuid_legacy(cs); } hv_cpuid_cache = cpuid; |