Hi Andrew, > On Nov 2, 2023, at 04:37, Andrew Cooper <[email protected]> wrote: > > As reported: > > (XEN) > ================================================================================ > (XEN) UBSAN: Undefined behaviour in arch/x86/time.c:1542:32 > (XEN) member access within null pointer of type 'union vcpu_info_t' > (XEN) ----[ Xen-4.19-unstable x86_64 debug=y ubsan=y Not tainted ]---- > ... > (XEN) Xen call trace: > (XEN) [<ffff82d040345036>] R common/ubsan/ubsan.c#ubsan_epilogue+0xa/0xd2 > (XEN) [<ffff82d0403456e8>] F __ubsan_handle_type_mismatch+0x133/0x49b > (XEN) [<ffff82d040345b4a>] F __ubsan_handle_type_mismatch_v1+0xfa/0xfc > (XEN) [<ffff82d040623356>] F > arch/x86/time.c#__update_vcpu_system_time+0x212/0x30f > (XEN) [<ffff82d040623461>] F update_vcpu_system_time+0xe/0x10 > (XEN) [<ffff82d04062389d>] F > arch/x86/time.c#local_time_calibration+0x1f7/0x523 > (XEN) [<ffff82d0402a64b5>] F common/softirq.c#__do_softirq+0x1f4/0x31a > (XEN) [<ffff82d0402a67ad>] F do_softirq+0x13/0x15 > (XEN) [<ffff82d0405a95dc>] F arch/x86/domain.c#idle_loop+0x2e0/0x367 > (XEN) > (XEN) > ================================================================================ > > It is not valid to derive a pointer from vcpu_info() prior to checking that > the underlying map pointer is good. > > Reorder actions so the NULL pointer check is first. > > Fixes: 20279afd7323 ("x86: split populating of struct vcpu_time_info into a > separate function") > Signed-off-by: Andrew Cooper <[email protected]> > --- > CC: Jan Beulich <[email protected]> > CC: Roger Pau Monné <[email protected]> > CC: Wei Liu <[email protected]> > CC: Henry Wang <[email protected]> > > 4.18 blocker, or we'll need to issue an XSA/CVE.
Release-acked-by: Henry Wang <[email protected]> Kind regards, Henry
