'vector' and 'trig_mode' fields of 'struct kvm_lapic_irq' are left uninitialized in kvm_pv_kick_cpu_op(). While these fields are normally not needed for APIC_DM_REMRD, they're still referenced by __apic_accept_irq() for trace_kvm_apic_accept_irq(). Fully initialize the structure to avoid consuming random stack memory.
Unified · Split
| @@ -9143,15 +9143,17 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr, · 9142 unmodified lines | |||
| 9143 | */ | 9143 | */ |
| 9144 | static void kvm_pv_kick_cpu_op(struct kvm *kvm, int apicid) | 9144 | static void kvm_pv_kick_cpu_op(struct kvm *kvm, int apicid) |
| 9145 | { | 9145 | { |
| 9146 | struct kvm_lapic_irq lapic_irq; | 9146 | /* |
| 9147 | 9147 | * All other fields are unused for APIC_DM_REMRD, but may be consumed by | |
| 9148 | lapic_irq.shorthand = APIC_DEST_NOSHORT; | 9148 | * common code, e.g. for tracing. Defer initialization to the compiler. |
| 9149 | lapic_irq.dest_mode = APIC_DEST_PHYSICAL; | 9149 | */ |
| 9150 | lapic_irq.level = 0; | 9150 | struct kvm_lapic_irq lapic_irq = { |
| 9151 | lapic_irq.dest_id = apicid; | 9151 | .delivery_mode = APIC_DM_REMRD, |
| 9152 | lapic_irq.msi_redir_hint = false; | 9152 | .dest_mode = APIC_DEST_PHYSICAL, |
| 9153 | .shorthand = APIC_DEST_NOSHORT, | ||
| 9154 | .dest_id = apicid, | ||
| 9155 | }; | ||
| 9153 | 9156 | ||
| 9154 | lapic_irq.delivery_mode = APIC_DM_REMRD; | ||
| 9155 | kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL); | 9157 | kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL); |
| 9156 | } | 9158 | } |
| 9157 | 9159 | ||