From nobody Sat May 30 11:15:04 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1779715283; cv=none; d=zohomail.com; s=zohoarc; b=k/E3rlyjbb0fsVQjej19wK+ZFzYVig4ixj4qJMVRlH71WyJUTdxCykTuSMr+GBE+aMy/eNuO6/78AlwINGTFRSG4HdFxdwiYMfKJxMQjaqL+TZqBbHLxL2A0dinQeonwrys+LDQorTNBujgL4s3z1bX4Igt1b0NRi5Cbj8VY+hY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779715283; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mhYowuyAWGSpmaN++lAXXVAbSyUZzptdaqiWvdE8iRk=; b=me/j+D0a5hw/DA3FTFnU2W4F/BkllUnu4CRzJTGhcrGJQQI5sodkqUgefvwrmvQ6Yz+cx4Uoo3e9SH+CMTJCR/OrbeVljh1xiXqD6NvCqqSTTwQ6UQi8aOgaxeQ4+700dpDONw5B+QbxgeK/UEjN0DEdLxH2KnS0MSuYibK9M60= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1779715283301465.89140539979326; Mon, 25 May 2026 06:21:23 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1319263.1586954 (Exim 4.92) (envelope-from ) id 1wRVEq-0000OQ-EV; Mon, 25 May 2026 13:21:00 +0000 Received: by outflank-mailman (output) from mailman id 1319263.1586954; Mon, 25 May 2026 13:21:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRVEq-0000OH-Az; Mon, 25 May 2026 13:21:00 +0000 Received: by outflank-mailman (input) for mailman id 1319263; Mon, 25 May 2026 13:20:59 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) id 1wRVEp-0000Am-7A for xen-devel@lists.xenproject.org; Mon, 25 May 2026 13:20:59 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRVEo-00FBlO-Ce for xen-devel@lists.xenproject.org; Mon, 25 May 2026 15:20:58 +0200 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a144cb6-2eae-0a2a0a5409dd-0a2a450bc874-2 for ; Mon, 25 May 2026 15:20:58 +0200 Received: from [209.85.128.41] (helo=mail-wm1-f41.google.com) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a144cba-212f-0a2a450b0019-d1558029ec5d-3 for ; Mon, 25 May 2026 15:20:58 +0200 Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-49056b9f04aso23460195e9.0 for ; Mon, 25 May 2026 06:20:58 -0700 (PDT) Received: from fedora (user-109-243-69-121.play-internet.pl. [109.243.69.121]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4904526ca21sm247101985e9.3.2026.05.25.06.20.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 06:20:56 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779715258; x=1780320058; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mhYowuyAWGSpmaN++lAXXVAbSyUZzptdaqiWvdE8iRk=; b=h+NL8aXgs+6cVmWHqSA0JpneZl8KikOtvxPqpozCYSp8U4ATGEHA1gnyBqlKxIK19o aV2e6JfL/ZbSmLM0xaW6Tjtg/1O+G129/9vZ6OEF/nTr2vSVN5HPvCxz5yYEazovHobF nF/CamXqZSt2v0HqldWtFyAlC2SE5LlcrhwgMfL28nca5QHdAgwB0KmdlwRkDJfmdVrg ERM8O8sQgmiuo/nQf/INcLh72FnD8jSQ2f7/F50P3XJY9DtpzoVnJKzd9dfOtwvrbNZt 6oKYrIsOoLrtjbOzSJCuDrtm6HswiQ4+nnwCj8/g+TUENKs60SkJLj/hgaDh88CVMX/L nTkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779715258; x=1780320058; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=mhYowuyAWGSpmaN++lAXXVAbSyUZzptdaqiWvdE8iRk=; b=kk7+fqIbhCIIDTwyDaOEDkq/mKs6hbsrGxQDDgyXWvn4J+xOMi6oOiZ14ka8icBhTv BfefXh/SfWzx6g8jnQF1me/7JnRhW3dA7Lm+RbFh+c4ZEFHf1S554SjRKs3o7x2aRcMS Z6Z+WHS0XjsF1nWnkx91rfwWa4gz/bRKcXe0qemE3g20+jOIH7Ms3mZNhgEdTqjoFoJ5 wL+YSf9+n8Xw+F+XE9QDCsL620pzqlkbWbLClPAw97b0JMdK7Stw8X181666ZaRF9mR3 9GlittDzn/dZKQAw85VAjVVGPAebuKW/czORr8/2eKydlXkieB5EEBtMa+Y85rn40ebD ObDQ== X-Gm-Message-State: AOJu0YxYWIesY9YZVrhaL3sT4EEq1wjqW9Nn4a1S5QCjVKlF5idAVjmE E9yi4QHJ5XtAmWuSe0TVIzGQmK8lklfmuicqt8BM+Wcu7ejGeGchoYuiRFUi+1ci X-Gm-Gg: Acq92OF/gtmQviSEOplrzxK2Yh8imyQmnXjb2hCK2/lEPswWBvb4cAiOp2LMAhhvyJ6 BSSF2uzVOBEettAVqXZ2+3Up7yqj6GRLjwTld4lOyOPJMl5y3OM+h/WEImhxGxAkbda4+TobMnu 4GeLoMVLEyv/mAaBAUYZpP4O/kb1TyUyxukBiCRHeVVwl3js4P+46TDNg4u61JhApX85oI0at5F +XB8ahC26uax7m3exbt7YylFBEOvlq1qTCXq5A6yw9AFy1KAz69d8fEwdYveMgveGIXfqsDM5HE BXo5OqSZ3R1ksxgeBWpzow4fofORCYTiEo0YLoVihYX/auJRrOp6wKH70dB5jfKiRv4Mr+WVAF2 D24v+q1DigtWQd4ZONRKoNd6u/L60Zp1mJvz7zZuQWAiW1ANRM4ueb7MHLwVYOicM/e4aKsw8O6 oNAYoxtqpsfJqnqNoh/Cb471SuMNLejD9IrtOWfLTtgyYZkcJi/JxyxnW4OlAZaEb6vZaM96BCh lxG X-Received: by 2002:a05:600c:8b12:b0:490:5191:6e1a with SMTP id 5b1f17b1804b1-490519170d7mr184485815e9.24.1779715257471; Mon, 25 May 2026 06:20:57 -0700 (PDT) From: Oleksii Kurochko To: xen-devel@lists.xenproject.org Cc: Oleksii Kurochko , Alistair Francis , Connor Davis , Andrew Cooper , Anthony PERARD , Michal Orzel , Jan Beulich , Julien Grall , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Stefano Stabellini , Baptiste Le Duc Subject: [PATCH v2 1/3] xen/riscv: fix switch_stack_and_jump() for range beyond 1M Date: Mon, 25 May 2026 15:20:42 +0200 Message-ID: <21bc40d4a09bb4cfe0999430ea7e65b369fd4033.1779712171.git.oleksii.kurochko@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-purgate-ID: tlsNG-42698a/1779715258-18B60F3B-4DFE5F36/10/73395122804 X-purgate-type: spam X-purgate-size: 2202 X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1779715284574158500 The `j` instruction (JAL x0) used in switch_stack_and_jump() is a J-type instruction with only a =C2=B11MB range, and that this can be exceeded in some configurations, causing a linker error: relocation truncated to fit: R_RISCV_JAL against `' Replace `j` with `jr` (JALR x0) via an explicit register, which has unlimited range. Found in a downstream branch when UBSAN instrumentation was enabled. Note that the `tail` instruction looks more natural here, but `jr` is chosen instead to avoid depending on how the assembler expands `tail` and which scratch register it uses (`t1` in GAS), which would need to be listed in the clobber section of `asm volatile`. Fixes: e66003e7be199 ("xen/riscv: introduce setup_initial_pages") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc --- Changes in v2: - Update the commit message and subject --- xen/arch/riscv/include/asm/current.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/xen/arch/riscv/include/asm/current.h b/xen/arch/riscv/include/= asm/current.h index 5fbee8182caa..cc004670d18c 100644 --- a/xen/arch/riscv/include/asm/current.h +++ b/xen/arch/riscv/include/asm/current.h @@ -51,11 +51,11 @@ DECLARE_PER_CPU(struct vcpu *, curr_vcpu); #define vcpu_guest_cpu_user_regs(vcpu) \ (&(vcpu)->arch.cpu_info->guest_cpu_user_regs) =20 -#define switch_stack_and_jump(stack, fn) do { \ - asm volatile ( \ - "mv sp, %0\n" \ - "j " #fn :: "r" (stack), "X" (fn) : "memory" ); \ - unreachable(); \ +#define switch_stack_and_jump(stack, fn) do { \ + asm volatile ( \ + "mv sp, %0\n" \ + "jr %1" :: "r" (stack), "r" (fn) : "memory" ); \ + unreachable(); \ } while ( false ) =20 #define get_per_cpu_offset() __per_cpu_offset[smp_processor_id()] --=20 2.54.0 From nobody Sat May 30 11:15:04 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1779715296; cv=none; d=zohomail.com; s=zohoarc; b=kJjyWGkhH92evgYkdh0szUSf2t9RwMzQaQ49+9eDRhRA5I8jFmZ110/QOQoO36E3ubTrEsGpn52rR/clgOJLT0wr7HK1xDHm7vfcj8fuucqWoygRhVQ8cEPu4m0wxILSq3MKtWyey7cUHyURY4eY8dR9G+nnLbJez/srWvh0e/Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779715296; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Y01U/cIdeBHcv5iWEI8HdRJZlY3tdB5kvE1STP1YdwU=; b=P/FzGqtu6tSsPlQWOtDE+aKlTdC7nqBJBpb3IqCa2hbh54lA9Nw8vF3L1tjoN3b1ztkoM/BUO+/Bt+EECTDli0nQsfdwuJWG7ZJ5V8KRbBVdwM5nuEMBDMnMERsnk5pntG//N5xYBjxkdnNnCIQlnB1CDulrJav8i2Lpy1Pc70A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1779715296190444.4984445953677; Mon, 25 May 2026 06:21:36 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1319264.1586963 (Exim 4.92) (envelope-from ) id 1wRVEr-0000bT-PH; Mon, 25 May 2026 13:21:01 +0000 Received: by outflank-mailman (output) from mailman id 1319264.1586963; Mon, 25 May 2026 13:21:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRVEr-0000bM-LW; Mon, 25 May 2026 13:21:01 +0000 Received: by outflank-mailman (input) for mailman id 1319264; Mon, 25 May 2026 13:21:00 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) id 1wRVEq-0000ON-IX for xen-devel@lists.xenproject.org; Mon, 25 May 2026 13:21:00 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRVEp-00DYzL-Uo for xen-devel@lists.xenproject.org; Mon, 25 May 2026 15:20:59 +0200 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a144ca0-bab6-0a2a0a5309dd-0a2a4504bc44-26 for ; Mon, 25 May 2026 15:20:59 +0200 Received: from [209.85.128.54] (helo=mail-wm1-f54.google.com) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a144cbb-1dec-0a2a45040019-d1558036b511-3 for ; Mon, 25 May 2026 15:20:59 +0200 Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4906869f0cbso6852675e9.1 for ; Mon, 25 May 2026 06:20:59 -0700 (PDT) Received: from fedora (user-109-243-69-121.play-internet.pl. [109.243.69.121]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4904526ca21sm247101985e9.3.2026.05.25.06.20.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 06:20:58 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779715259; x=1780320059; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Y01U/cIdeBHcv5iWEI8HdRJZlY3tdB5kvE1STP1YdwU=; b=lXidjKzQ9FDcmeQfJHsotFVw6fopOjayFqcLzGrZVxk90XRsQBUrwuInxdCm00ITmC h6yvCfIR74XV0uE+Zcw8+OaR+A4My2SQQaHL+8P2HQzJCMTTckpZ/OCUTSZ55dexowu6 OKVsXmLerkgjLvIpG2AEd9F2hVg++fc9FBDOpKKXtv6OWjH2R9hIZggI2hffWtOZxRDD lH9GMcZ9cNMUQLM9kgWTlKzrAUN6fqDD+5TFcUsh05Kj2MZEm9KtgcEqj225EjaovPq4 vj+I+ve8K8o/oqTrwEkCdlRgGdI/qwo+ooDQBl1MsxnrmpyS8n/lykTTkoH0xn85ih55 XYkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779715259; x=1780320059; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Y01U/cIdeBHcv5iWEI8HdRJZlY3tdB5kvE1STP1YdwU=; b=QFMbJTzJCXzh9LDcxcZo1fSjqq/3I+O2CCtIqKFw83cKeOBdqiNMFmPujI78ZprE2g tfzcnScsZDm0r/TAAUz2J9HbLJeV6v6t6A5E2oXIxqtXYvJG/2BlxMxQurzigXcqKD9U n1g+Rj1diLlZ/3fKRxiDtmxkWFau4qAM0/apACQ4jWgxwYH+xVRNrJNfYDnyjCHA2Y6F Kw/+QegPnd71Bd6REKqvHnRDEJ3Ryx6Wl5t9cAGqDBgLLziQaxWRRHWbxHxC+btFyXyN MRhW3uOwYYWQWwHnDJ8vdbf3pRDuxIMEoAMPzT/0Ak40sNko8xbLo20FHIMZCwccpatW qvkw== X-Gm-Message-State: AOJu0Yz1kwA8UVtt0xh995QW363H4952h7cAXQ9rTecjsgcusLtHNWe1 OJ8zti6fioGz0j73vJTTCXJxqMwmThZeh44vsvXO1HGCVLpklkXao7vECfTiv45a X-Gm-Gg: Acq92OFArsnl9RVpN7oMIG6yEPia1OWFchmW3ezrYPctbVsogcTnPAxXpJL+PEeibt8 ac7giFR/giZAnM0qTj/JWFHel0yYe26oFMUntSASYxjwq6qHfi2Z31Z5EbfWHCDohKyPfHvwJ6s uEM4/kbjfJ+hb04RF5o/YRtyhIjBlJUBGu03YcUcVzi9Swqbm02HJcVb+CxjVDYfX+yCEQ1GM7V mc5MHB6HdpjTQK+FoxWvjs7TBIMznOUtnU9MbCqQPNOCikfM711f4WCJjaSf/3H1FJxlxPEtb2W ji89dcWYDKOAcZtcontrq0XYZGGHWiQzchRulEJD/WAMEfWbWcBF4BZmbocg880FVkgcRu0iAdu eckYr6m6bc93Si+eMHL+9+Em6xorgTzUwE7udvPS/7QGhsICTSSCebG3y258gMRaGjSk4TTM0Ds +kRAn1BrDsw87lIGB3qARXBVyT4/yYS7jtN4214POZOY5djzdpadm/PrETsbuURlF+3A== X-Received: by 2002:a05:600c:4510:b0:48f:d5a0:284e with SMTP id 5b1f17b1804b1-490428e03b8mr229165155e9.28.1779715259120; Mon, 25 May 2026 06:20:59 -0700 (PDT) From: Oleksii Kurochko To: xen-devel@lists.xenproject.org Cc: Oleksii Kurochko , Andrew Cooper , Anthony PERARD , Michal Orzel , Jan Beulich , Julien Grall , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Stefano Stabellini Subject: [PATCH v2 2/3] xen/domain: fix UBSAN null pointer dereference of d->shared_info Date: Mon, 25 May 2026 15:20:43 +0200 Message-ID: <04dd784b6b9a4dfca9a313ea8802d8d514d65021.1779712171.git.oleksii.kurochko@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-purgate-ID: tlsNG-ebf023/1779715259-40B733FF-A7992848/10/73395122804 X-purgate-type: spam X-purgate-size: 3702 X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1779715298300158500 Content-Type: text/plain; charset="utf-8" It is legal to have d->shared_info equal to NULL for architectures which support only the FIFO ABI for event channel management. Having d->shared_info =3D=3D NULL leads to a UBSAN issue on such architectu= res: UBSAN: Undefined behaviour in common/domain.c:325:10 member access within null pointer of type 'struct shared_info_t' vcpu_info_reset() maps v->vcpu_info_area.map to the per-vcpu slot inside the domain's shared_info page for vcpus with id < XEN_LEGACY_MAX_VCPUS, and falls back to dummy_vcpu_info for vcpus beyond that limit. Extend the existing fallback condition to also cover the case where no shared_info page has been allocated, mapping the vcpu to dummy_vcpu_info instead. This is the correct behaviour: dummy_vcpu_info already serves as the safe stand-in for vcpus that have no usable shared_info slot. Additionally, if an architecture supports only the FIFO ABI, setup_ports() should be updated to avoid a NULL pointer dereference of d->shared_info, since in that case there will be no pending events in shared_info->evtchn_pending and the pending flag of the FIFO event channel does not need to be set to true. update_domain_wallclock_time() accesses d->shared_info via shared_info() macro. On architectures that do not allocate a shared_info page (currently RISC-V, which runs guests in dom0less mode without the PV ABI), this causes a NULL dereference. The early return is safe: if there is no shared_info page, there is nothing to update. For all existing architectures (x86, ARM) that do allocate it, the guard is never taken and behavior is unchanged. Signed-off-by: Oleksii Kurochko --- Changes in v2: - Update commit message + subject. - Drop Fixes tag. - Handle migration of pending events from 2L and FIFO ABIs when arch support only FIFO ABI. - Update the commit message. - Protect some other places in common code from NULL pointer deref of d->shared_info. - Drop R-by: Baptiste ... as some extra checks are added. --- xen/common/domain.c | 2 +- xen/common/event_fifo.c | 3 ++- xen/common/time.c | 3 +++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index bb9e210c2895..e64b7df9b704 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -320,7 +320,7 @@ void vcpu_info_reset(struct vcpu *v) struct domain *d =3D v->domain; =20 v->vcpu_info_area.map =3D - ((v->vcpu_id < XEN_LEGACY_MAX_VCPUS) + ((v->vcpu_id < XEN_LEGACY_MAX_VCPUS && d->shared_info) ? (vcpu_info_t *)&shared_info(d, vcpu_info[v->vcpu_id]) : &dummy_vcpu_info); } diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc4564..59d9bf4c7ec0 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -562,7 +562,8 @@ static void setup_ports(struct domain *d, unsigned int = prev_evtchns) =20 evtchn =3D evtchn_from_port(d, port); =20 - if ( guest_test_bit(d, port, &shared_info(d, evtchn_pending)) ) + if ( d->shared_info && + guest_test_bit(d, port, &shared_info(d, evtchn_pending)) ) evtchn->pending =3D true; =20 evtchn_fifo_set_priority(d, evtchn, EVTCHN_FIFO_PRIORITY_DEFAULT); diff --git a/xen/common/time.c b/xen/common/time.c index 04a65f00b35c..1ee49a8b0d13 100644 --- a/xen/common/time.c +++ b/xen/common/time.c @@ -94,6 +94,9 @@ void update_domain_wallclock_time(struct domain *d) uint32_t *wc_version; uint64_t sec; =20 + if ( !d->shared_info ) + return; + spin_lock(&wc_lock); =20 wc_version =3D &shared_info(d, wc_version); --=20 2.54.0 From nobody Sat May 30 11:15:04 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1779715283; cv=none; d=zohomail.com; s=zohoarc; b=iwPTJD1aH+WsE5rgMVEJjPXelx8gFqai5rJCyCIBleCi/3E5JV9KvW7YPHX0aXMJMhsn2R9tLGhr64nJC2vDPxB11IOH1XcFp0liFheyesyfVRzEaSvfX+jp8go4BbWrK7ShukjQHuaFSqlXD5/Y1XjqwvzZN6IfTh42S3neJrY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779715283; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LnvKC3uKIYyQyLpDODWpeTmvo1taBNlFPdhQ7OBPgd4=; b=cRXw6vzcR5W1+HRrWzX1ywxIvnT3679mZ8I6dUpMeE/zztrIq3oEugYf8XosICs6WQ/i4brlX8dSS+cwzxTRAH9P54WgKkojnrSb9mKlhi4obBXXJfIMYYYrrKQQciXBSisuLk2NULbejLgnjGDVtcz5ObXDkZQ59t0Gy6EFNio= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1779715283008815.0082141730654; Mon, 25 May 2026 06:21:23 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1319265.1586972 (Exim 4.92) (envelope-from ) id 1wRVEu-0000pv-0T; Mon, 25 May 2026 13:21:04 +0000 Received: by outflank-mailman (output) from mailman id 1319265.1586972; Mon, 25 May 2026 13:21:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRVEt-0000pm-So; Mon, 25 May 2026 13:21:03 +0000 Received: by outflank-mailman (input) for mailman id 1319265; Mon, 25 May 2026 13:21:02 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) id 1wRVEs-0000h4-6e for xen-devel@lists.xenproject.org; Mon, 25 May 2026 13:21:02 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRVEr-00HD0O-It for xen-devel@lists.xenproject.org; Mon, 25 May 2026 15:21:01 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a144c9e-e002-0a2a0a5209dd-0a2a450cd30e-22 for ; Mon, 25 May 2026 15:21:01 +0200 Received: from [209.85.128.44] (helo=mail-wm1-f44.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a144cbd-62f1-0a2a450c0019-d155802cdc96-3 for ; Mon, 25 May 2026 15:21:01 +0200 Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4905529b933so13307365e9.0 for ; Mon, 25 May 2026 06:21:01 -0700 (PDT) Received: from fedora (user-109-243-69-121.play-internet.pl. [109.243.69.121]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4904526ca21sm247101985e9.3.2026.05.25.06.20.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 06:21:00 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779715261; x=1780320061; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LnvKC3uKIYyQyLpDODWpeTmvo1taBNlFPdhQ7OBPgd4=; b=i7ULngCd7rwk9j1/VqYvxIFyrV5pT00sKpQDMGBHxXu8XJyl/bTHG/r4UJ8JktD6mB Qps3FRJlBa8pV45gwVWb0Vq8dHCMglahS4QUuoU5fnn6UWq+d4xXbdOPGHzjQb06UoHm jGNzUfX4wiw83TmdhEloSv2XI/Dc7UcbM0Pbp3YC4qFXvJySvW9i7KJ+8twzWjRgoOqq KOb+D2BXfXfpH9wpJJ7VBcsrI9Y2BR4+LojhS2ItBrQiztXnwRf6jRPy/HiHHtjGkzJ2 oz+N5xtg2ZEUnU22SEqTWkeijyh97tQW+PWAinu+OwijOXdHt0w9wVI+vEFjVhiyx3qN x2bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779715261; x=1780320061; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=LnvKC3uKIYyQyLpDODWpeTmvo1taBNlFPdhQ7OBPgd4=; b=AIt0GyLzMV5uS0H8UdeVpxNfgBLgB/z7/x3BICpU+1J36dqn6jsRp4xekXDeGL2z+D k2YYlZgBrY61mvYgWe9TnIU8HoM0grVFPS30Vel4vZVHO2LB4qMsLM2ddRKWKKvV7lhD FFKUtXaHVGpbSRLmMqo98lNPtpAYXiwe/M1EEBBBgGoEm3oKWaSDowrVhLnHSdf5zQNu e+iyp5e9XmKvuMXigde1OdfHmZRgSCGir0FCZr7t335kPYbcrupHlQp1zVjQVADRjCb8 zMUKJ++vJ+b5btZKMrWaR8eHKrlerWDpoLYVYkzLof8LlzSjIVvWfvz1nJ3Stf1UUyFo J2pg== X-Gm-Message-State: AOJu0YwVHyixmNY+ZsSyJlf9PK70h98IrofZGz6vKHg2ybo1llKOlLul Nf7MVxQ9D4irsH4wVA1C6raGQodooHvt1B+Npw8n5HlRB97N/i/h+wAQI6lPun1n X-Gm-Gg: Acq92OHi4C9iyo0LphWtY06F1WmhhBhhL7KBXr44xrc0FC+gO7pSK+S61gMiI7vfrVn GkssFVzN6/2IPbajcwyn3HeaeuJvq3D1QqSSfyeJji/wXX1DHPXhToE1a4QgydUVwoEilAyMk08 7C83oWZ14gyLC7Vl3y5CNYVjav1PdNPdo45RI+xA55oyeuJXrgNNJTUMmCvHUzgouzGHa7aivnk ZOtTxABfMKYvjKDfVD0GBGRfQj4Afqh0odlAel1OjRNR9wt95aHpIkqg/mMneOhosGDS/50C7Nk 6XqzDAuylfVMsrrdkrg2hUVyGj2A58P6dowgf1HS7flDfXWhVGeYpQ6ovggofdYHUt24h9ssc0z 9UeGKDeWQl7zootq2V01xJJ2baz3h0gBb1vtK983J2+2MTg6iiAMhkAbPP6VESCnYLSaSWgT4GX IuEAKAP7W0fuFZqUo+Fno9NTBD5XxZO0LznhCnMuiamXBti71WqfjSrw7XKSe8OhxeyA== X-Received: by 2002:a05:600c:4510:b0:48a:53ea:140b with SMTP id 5b1f17b1804b1-490428ddf15mr222949465e9.28.1779715260801; Mon, 25 May 2026 06:21:00 -0700 (PDT) From: Oleksii Kurochko To: xen-devel@lists.xenproject.org Cc: Oleksii Kurochko , Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel , David Gibson , Baptiste Le Duc Subject: [PATCH v2 3/3] libfdt: fix UBSAN null pointer in fdt_property() Date: Mon, 25 May 2026 15:20:44 +0200 Message-ID: <248482e608157a7156f7bb6d8a809540a50f3f86.1779712171.git.oleksii.kurochko@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-purgate-ID: tlsNG-d25034/1779715261-E1B6CCF5-167C92D7/10/73395122804 X-purgate-type: spam X-purgate-size: 1556 X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1779715284569158500 Content-Type: text/plain; charset="utf-8" fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel --- Changes in v2: - Backport patch from https://github.com/dgibson/dtc/commit/f57e7df35df4a3= 01961cbbf9433ba4e85c2ee5ed --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb0d..96d4cf571319 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const voi= d *val, int len) ret =3D fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; } =20 --=20 2.54.0