| Message ID | 20200416191152.259434-1-jcargill@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: Remove CREATE_IRQCHIP/SET_PIT2 race | expand |
On 16/04/20 21:11, Jon Cargille wrote: > From: Steve Rutherford <srutherford@google.com> > > Fixes a NULL pointer dereference, caused by the PIT firing an interrupt > before the interrupt table has been initialized. > > SET_PIT2 can race with the creation of the IRQchip. In particular, > if SET_PIT2 is called with a low PIT timer period (after the creation of > the IOAPIC, but before the instantiation of the irq routes), the PIT can > fire an interrupt at an uninitialized table. > > Signed-off-by: Steve Rutherford <srutherford@google.com> > Signed-off-by: Jon Cargille <jcargill@google.com> > Reviewed-by: Jim Mattson <jmattson@google.com> > --- > arch/x86/kvm/x86.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index 027dfd278a973..3cc3f673785c8 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -5049,10 +5049,13 @@ long kvm_arch_vm_ioctl(struct file *filp, > r = -EFAULT; > if (copy_from_user(&u.ps, argp, sizeof(u.ps))) > goto out; > + mutex_lock(&kvm->lock); > r = -ENXIO; > if (!kvm->arch.vpit) > - goto out; > + goto set_pit_out; > r = kvm_vm_ioctl_set_pit(kvm, &u.ps); > +set_pit_out: > + mutex_unlock(&kvm->lock); > break; > } > case KVM_GET_PIT2: { > @@ -5072,10 +5075,13 @@ long kvm_arch_vm_ioctl(struct file *filp, > r = -EFAULT; > if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) > goto out; > + mutex_lock(&kvm->lock); > r = -ENXIO; > if (!kvm->arch.vpit) > - goto out; > + goto set_pit2_out; > r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2); > +set_pit2_out: > + mutex_unlock(&kvm->lock); > break; > } > case KVM_REINJECT_CONTROL: { > Queued, thanks. Paolo
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 027dfd278a973..3cc3f673785c8 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5049,10 +5049,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps, argp, sizeof(u.ps))) goto out; + mutex_lock(&kvm->lock); r = -ENXIO; if (!kvm->arch.vpit) - goto out; + goto set_pit_out; r = kvm_vm_ioctl_set_pit(kvm, &u.ps); +set_pit_out: + mutex_unlock(&kvm->lock); break; } case KVM_GET_PIT2: { @@ -5072,10 +5075,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) goto out; + mutex_lock(&kvm->lock); r = -ENXIO; if (!kvm->arch.vpit) - goto out; + goto set_pit2_out; r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2); +set_pit2_out: + mutex_unlock(&kvm->lock); break; } case KVM_REINJECT_CONTROL: {