lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 65/90] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race
    Date
    From: Steve Rutherford <srutherford@google.com>

    [ Upstream commit 7289fdb5dcdbc5155b5531529c44105868a762f2 ]

    Fixes a NULL pointer dereference, caused by the PIT firing an interrupt
    before the interrupt table has been initialized.

    SET_PIT2 can race with the creation of the IRQchip. In particular,
    if SET_PIT2 is called with a low PIT timer period (after the creation of
    the IOAPIC, but before the instantiation of the irq routes), the PIT can
    fire an interrupt at an uninitialized table.

    Signed-off-by: Steve Rutherford <srutherford@google.com>
    Signed-off-by: Jon Cargille <jcargill@google.com>
    Reviewed-by: Jim Mattson <jmattson@google.com>
    Message-Id: <20200416191152.259434-1-jcargill@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/kvm/x86.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 6b7faa14c27bb..3c0f9be107e42 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -4263,10 +4263,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
    r = -EFAULT;
    if (copy_from_user(&u.ps, argp, sizeof u.ps))
    goto out;
    + mutex_lock(&kvm->lock);
    r = -ENXIO;
    if (!kvm->arch.vpit)
    - goto out;
    + goto set_pit_out;
    r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
    +set_pit_out:
    + mutex_unlock(&kvm->lock);
    break;
    }
    case KVM_GET_PIT2: {
    @@ -4286,10 +4289,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
    r = -EFAULT;
    if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
    goto out;
    + mutex_lock(&kvm->lock);
    r = -ENXIO;
    if (!kvm->arch.vpit)
    - goto out;
    + goto set_pit2_out;
    r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
    +set_pit2_out:
    + mutex_unlock(&kvm->lock);
    break;
    }
    case KVM_REINJECT_CONTROL: {
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 04:26    [W:5.153 / U:0.408 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site