linux-kernel - [PATCH] KVM: LAPIC: Fix an inversion error when a negative value assigned to lapic_timer.timer_advance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 May 2024 19:53:34 +0800
From: <zhoushuling@...wei.com>
To: <seanjc@...gle.com>, <pbonzini@...hat.com>
CC: <weiqi4@...wei.com>, <zhoushuling@...wei.com>, <wanpengli@...cent.com>,
	<kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] KVM: LAPIC: Fix an inversion error when a negative value assigned to lapic_timer.timer_advance_ns

From: Shuling Zhou <zhoushuling@...wei.com>

After 'commit 0e6edceb8f18 ("KVM: LAPIC: Fix lapic_timer_advance_ns
parameter overflow")',a negative value can be assigned to
lapic_timer_advance_ns, when it is '-1', the kvm_create_lapic()
will judge it and turns on adaptive tuning of timer advancement.
However, when lapic_timer_advance_ns=-2, it will be assigned to
an uint variable apic->lapic_timer.timer_advance_ns, the
apic->lapic_timer.timer_advance_ns of each vCPU will become a huge
value. When a VM is started, the VM is stuck in the
"
[    2.669717] ACPI: Core revision 20130517
[    2.672378] ACPI: All ACPI Tables successfully acquired
[    2.673309] ftrace: allocating 29651 entries in 116 pages
[    2.698797] Enabling x2apic
[    2.699431] Enabled x2apic
[    2.700160] Switched APIC routing to physical x2apic.
[    2.701644] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[    2.702575] smpboot: CPU0: Intel(R) Xeon(R) Platinum 8378A CPU @ 3.00GHz (fam: 06, model: 6a, stepping: 06)
.........
"

'Fixes: 0e6edceb8f18 ("KVM: LAPIC: Fix lapic_timer_advance_ns
parameter overflow")'

Cc: Paolo Bonzini <pbonzini@...hat.com>
Cc: Sean Christopherson <sean.j.christopherson@...el.com>
Cc: Wanpeng Li <wanpengli@...cent.com>
Signed-off-by: Shuling Zhou<zhoushuling@...wei.com>
---
 arch/x86/kvm/lapic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index ebf41023be38..5feeb889ddb6 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2848,7 +2848,7 @@ int kvm_create_lapic(struct kvm_vcpu *vcpu, int timer_advance_ns)
 	if (timer_advance_ns == -1) {
 		apic->lapic_timer.timer_advance_ns = LAPIC_TIMER_ADVANCE_NS_INIT;
 		lapic_timer_advance_dynamic = true;
-	} else {
+	} else if (timer_advance_ns >= 0) {
 		apic->lapic_timer.timer_advance_ns = timer_advance_ns;
 		lapic_timer_advance_dynamic = false;
 	}
-- 
2.27.0