KVM: x86/pmu: Avoid setting BIT_ULL(-1) to pmu->host_cross_mapped_mask

In the extreme case of host counters multiplexing and contention, the
perf_event requested by the guest's pebs counter is not allocated to any
actual physical counter, in which case hw.idx is bookkept as -1,
resulting in an out-of-bounds access to host_cross_mapped_mask.

Fixes: 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations")
Signed-off-by: Like Xu <likexu@tencent.com>
Link: https://lore.kernel.org/r/20220831085328.45489-2-likexu@tencent.com
[sean: expand comment to explain how a negative idx can be encountered]
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
index c399637..78dec4d 100644 (file)
--- a/arch/x86/kvm/vmx/pmu_intel.c
+++ b/arch/x86/kvm/vmx/pmu_intel.c
@@ -776,20 +776,23 @@ static void intel_pmu_cleanup(struct kvm_vcpu *vcpu)
 void intel_pmu_cross_mapped_check(struct kvm_pmu *pmu)
 {
        struct kvm_pmc *pmc = NULL;
-       int bit;
+       int bit, hw_idx;
 
        for_each_set_bit(bit, (unsigned long *)&pmu->global_ctrl,
                         X86_PMC_IDX_MAX) {
                pmc = intel_pmc_idx_to_pmc(pmu, bit);
 
                if (!pmc || !pmc_speculative_in_use(pmc) ||
-                   !intel_pmc_is_enabled(pmc))
+                   !intel_pmc_is_enabled(pmc) || !pmc->perf_event)
                        continue;
 
-               if (pmc->perf_event && pmc->idx != pmc->perf_event->hw.idx) {
-                       pmu->host_cross_mapped_mask |=
-                               BIT_ULL(pmc->perf_event->hw.idx);
-               }
+               /*
+                * A negative index indicates the event isn't mapped to a
+                * physical counter in the host, e.g. due to contention.
+                */
+               hw_idx = pmc->perf_event->hw.idx;
+               if (hw_idx != pmc->idx && hw_idx > -1)
+                       pmu->host_cross_mapped_mask |= BIT_ULL(hw_idx);
        }
 }