From 71c9568e290b51dfd7ab091ac98b272fd0aa0b90 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Thu, 10 Jul 2025 15:58:51 +0200 Subject: [PATCH 2/3] x86/viridian: avoid NULL pointer dereference in viridian_synic_deliver_timer_msg() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The function is called unconditionally, regardless of whether the SIM page is mapped. Avoid a NULL pointer dereference in viridian_synic_deliver_timer_msg() by checking whether the SIM page is mapped. This is CVE-2025-58142 / part of XSA-472. Fixes: 26fba3c85571 ('viridian: add implementation of synthetic timers') Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/viridian/synic.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/arch/x86/hvm/viridian/synic.c b/xen/arch/x86/hvm/viridian/synic.c index c3dc573b003d..e6cba7548f1b 100644 --- a/xen/arch/x86/hvm/viridian/synic.c +++ b/xen/arch/x86/hvm/viridian/synic.c @@ -338,6 +338,10 @@ bool viridian_synic_deliver_timer_msg(struct vcpu *v, unsigned int sintx, .DeliveryTime = delivery, }; + /* Don't assume SIM page to be mapped. */ + if ( !msg ) + return false; + /* * To avoid using an atomic test-and-set, and barrier before calling * vlapic_set_irq(), this function must be called in context of the -- 2.49.0