Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c035666 authored by Steve Rutherford's avatar Steve Rutherford Committed by Greg Kroah-Hartman
Browse files

KVM: Remove CREATE_IRQCHIP/SET_PIT2 race 



[ Upstream commit 7289fdb5dcdbc5155b5531529c44105868a762f2 ]

Fixes a NULL pointer dereference, caused by the PIT firing an interrupt
before the interrupt table has been initialized.

SET_PIT2 can race with the creation of the IRQchip. In particular,
if SET_PIT2 is called with a low PIT timer period (after the creation of
the IOAPIC, but before the instantiation of the irq routes), the PIT can
fire an interrupt at an uninitialized table.

Signed-off-by: default avatarSteve Rutherford <srutherford@google.com>
Signed-off-by: default avatarJon Cargille <jcargill@google.com>
Reviewed-by: default avatarJim Mattson <jmattson@google.com>
Message-Id: <20200416191152.259434-1-jcargill@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 99e4fecd

arch/x86/kvm/x86.c

+8 −2
Original line number Diff line number Diff line
@@ -4668,10 +4668,13 @@ long kvm_arch_vm_ioctl(struct file *filp, 
		r = -EFAULT;

		if (copy_from_user(&u.ps, argp, sizeof u.ps))

			goto out;

		mutex_lock(&kvm->lock);

		r = -ENXIO;

		if (!kvm->arch.vpit)

			goto out;

			goto set_pit_out;

		r = kvm_vm_ioctl_set_pit(kvm, &u.ps);

set_pit_out:

		mutex_unlock(&kvm->lock);

		break;

	}

	case KVM_GET_PIT2: {
@@ -4691,10 +4694,13 @@ long kvm_arch_vm_ioctl(struct file *filp, 
		r = -EFAULT;

		if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))

			goto out;

		mutex_lock(&kvm->lock);

		r = -ENXIO;

		if (!kvm->arch.vpit)

			goto out;

			goto set_pit2_out;

		r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);

set_pit2_out:

		mutex_unlock(&kvm->lock);

		break;

	}

	case KVM_REINJECT_CONTROL: {