File 68c01976-x86-Viridian-NULL-deref-in-viridian_synic_deliver_timer_msg.patch of Package xen.41885

# Commit 3a7b4f2897a352cff287be97d27150b290a5d1ee
# Date 2025-09-09 14:11:34 +0200
# Author Roger Pau Monne <roger.pau@citrix.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/viridian: avoid NULL pointer dereference in viridian_synic_deliver_timer_msg()

The function is called unconditionally, regardless of whether the SIM page
is mapped.  Avoid a NULL pointer dereference in
viridian_synic_deliver_timer_msg() by checking whether the SIM page is
mapped.

This is CVE-2025-58142 / part of XSA-472.

Fixes: 26fba3c85571 ('viridian: add implementation of synthetic timers')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/hvm/viridian/synic.c
+++ b/xen/arch/x86/hvm/viridian/synic.c
@@ -338,6 +338,10 @@ bool viridian_synic_deliver_timer_msg(st
         .DeliveryTime = delivery,
     };
 
+    /* Don't assume SIM page to be mapped. */
+    if ( !msg )
+        return false;
+
     /*
      * To avoid using an atomic test-and-set, and barrier before calling
      * vlapic_set_irq(), this function must be called in context of the