Skip to content

[PW_SID:1094075] RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler#1924

Closed
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1094075
Closed

[PW_SID:1094075] RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler#1924
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1094075

Conversation

@linux-riscv-bot
Copy link
Copy Markdown

PR for series 1094075 applied to workflow__riscv__fixes

Name: RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1094075
Version: 1

Linux RISC-V bot and others added 2 commits May 10, 2026 02:08
The SBI v0.1 SEND_IPI handler iterates over the hart mask and calls
kvm_get_vcpu_by_id() to find the target vcpu for each set bit. When a
guest provides a hart mask containing bits for non-existent vcpu_ids,
kvm_get_vcpu_by_id() returns NULL, which is then unconditionally
dereferenced by kvm_riscv_vcpu_set_interrupt(), causing a kernel crash.

Fix this by adding a NULL check before dereferencing the return value.
If the target vcpu is not found, skip it and break out of the loop.

Fixes: a046c2d ("RISC-V: KVM: Reorganize SBI code by moving SBI v0.1 to its own file")
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Assisted-by: OpenClaw:DeepSeek-V3.2
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot linux-riscv-bot force-pushed the workflow__riscv__fixes branch from 2d4fcdd to cd9d421 Compare May 14, 2026 08:49
@linux-riscv-bot linux-riscv-bot deleted the pw1094075 branch May 17, 2026 13:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants