[PATCH] RISC-V: KVM: Fix null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei()

[Anup Patel]

On Fri, Jan 30, 2026 at 3:46 PM Jiakai Xu <xujiakai2025 at iscas.ac.cn> wrote:
>
> kvm_riscv_vcpu_aia_rmw_topei() assumes that the per-vCPU IMSIC state has
> been initialized once AIA is reported as available and initialized at
> the VM level. This assumption does not always hold.
>
> Under fuzzed ioctl sequences, a guest may access the IMSIC TOPEI CSR
> before the vCPU IMSIC state is set up. In this case,
> vcpu->arch.aia_context.imsic_state is still NULL, and the TOPEI RMW path
> dereferences it unconditionally, leading to a host kernel crash.
>
> The crash manifests as:
>   Unable to handle kernel paging request at virtual address
>   dfffffff0000000e
>   ...
>   kvm_riscv_vcpu_aia_imsic_rmw arch/riscv/kvm/aia_imsic.c:909
>   kvm_riscv_vcpu_aia_rmw_topei arch/riscv/kvm/aia.c:231
>   csr_insn arch/riscv/kvm/vcpu_insn.c:208
>   system_opcode_insn arch/riscv/kvm/vcpu_insn.c:281
>   kvm_riscv_vcpu_virtual_insn arch/riscv/kvm/vcpu_insn.c:355
>   kvm_riscv_vcpu_exit arch/riscv/kvm/vcpu_exit.c:230
>   kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:1008
>   ...
>
> Fix this by explicitly checking whether the vCPU IMSIC state has been
> initialized before handling TOPEI CSR accesses. If not, forward the CSR
> emulation to user space.
>
> Fixes: 2f4d58f7635ae ("RISC-V: KVM: Virtualize per-HART AIA CSRs")
> Signed-off-by: Jiakai Xu <xujiakai2025 at iscas.ac.cn>
> Signed-off-by: Jiakai Xu <jiakaiPeanut at gmail.com>
> ---
>  arch/riscv/kvm/aia.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/arch/riscv/kvm/aia.c b/arch/riscv/kvm/aia.c
> index dad3181856600..c176b960d8a40 100644
> --- a/arch/riscv/kvm/aia.c
> +++ b/arch/riscv/kvm/aia.c
> @@ -228,6 +228,10 @@ int kvm_riscv_vcpu_aia_rmw_topei(struct kvm_vcpu *vcpu,
>         if (!kvm_riscv_aia_initialized(vcpu->kvm))
>                 return KVM_INSN_EXIT_TO_USER_SPACE;
>
> +       /* If IMSIC vCPU state not initialized then forward to user space */
> +       if (!vcpu->arch.aia_context.imsic_state)
> +               return KVM_INSN_EXIT_TO_USER_SPACE;
> +

This should be part of kvm_riscv_vcpu_aia_imsic_rmw().

Also, Fixes tag should point to:
db8b7e97d6137 ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC")

>         return kvm_riscv_vcpu_aia_imsic_rmw(vcpu, KVM_RISCV_AIA_IMSIC_TOPEI,
>                                             val, new_val, wr_mask);
>  }
> --
> 2.34.1
>

Regards,
Anup