'vector' and 'trig_mode' fields of 'struct kvm_lapic_irq' are left uninitialized in kvm_pv_kick_cpu_op(). While these fields are normally not needed for APIC_DM_REMRD, they're still referenced by __apic_accept_irq() for trace_kvm_apic_accept_irq(). Fully initialize the structure to avoid consuming random stack memory.
Unified · Split
| @@ -9143,15 +9143,17 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr, · 9142 unmodified lines | ||
| 9143 | 9143 | */ |
| 9144 | 9144 | static void kvm_pv_kick_cpu_op(struct kvm *kvm, int apicid) |
| 9145 | 9145 | { |
| 9146 | − struct kvm_lapic_irq lapic_irq; | |
| 9147 | − | |
| 9148 | − lapic_irq.shorthand = APIC_DEST_NOSHORT; | |
| 9149 | − lapic_irq.dest_mode = APIC_DEST_PHYSICAL; | |
| 9150 | − lapic_irq.level = 0; | |
| 9151 | − lapic_irq.dest_id = apicid; | |
| 9152 | − lapic_irq.msi_redir_hint = false; | |
| 9146 | + /* | |
| 9147 | + * All other fields are unused for APIC_DM_REMRD, but may be consumed by | |
| 9148 | + * common code, e.g. for tracing. Defer initialization to the compiler. | |
| 9149 | + */ | |
| 9150 | + struct kvm_lapic_irq lapic_irq = { | |
| 9151 | + .delivery_mode = APIC_DM_REMRD, | |
| 9152 | + .dest_mode = APIC_DEST_PHYSICAL, | |
| 9153 | + .shorthand = APIC_DEST_NOSHORT, | |
| 9154 | + .dest_id = apicid, | |
| 9155 | + }; | |
| 9153 | 9156 | |
| 9154 | − lapic_irq.delivery_mode = APIC_DM_REMRD; | |
| 9155 | 9157 | kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL); |
| 9156 | 9158 | } |
| 9157 | 9159 | |