From aba830fc0d20c25594bcfaa2febc8dc077f68172 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Date: Tue, 9 Sep 2025 14:25:01 +0200 Subject: [PATCH] x86/viridian: avoid NULL pointer dereference in update_reference_tsc() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The function is only called when the MSR has the enabled bit set, but even then the page might not be mapped because the guest provided gfn is not suitable. Prevent a NULL pointer dereference in update_reference_tsc() by checking whether the page is mapped. This is CVE-2025-27466 / part of XSA-472. Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page') Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich master commit: 5776a2e9db0155cfd76388c8197ca7788bb4b361 master date: 2025-09-09 14:11:09 +0200 --- xen/arch/x86/hvm/viridian/time.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 137577384f..ca6d526f46 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -26,6 +26,10 @@ static void update_reference_tsc(const struct domain *d, bool initialize) HV_REFERENCE_TSC_PAGE *p = rt->ptr; uint32_t seq; + /* Reference TSC page might not be mapped even if the MSR is enabled. */ + if ( !p ) + return; + if ( initialize ) clear_page(p);