Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e515705 authored by Avi Kivity's avatar Avi Kivity
Browse files

KVM: Ensure all vcpus are consistent with in-kernel irqchip settings 



If some vcpus are created before KVM_CREATE_IRQCHIP, then
irqchip_in_kernel() and vcpu->arch.apic will be inconsistent, leading
to potential NULL pointer dereferences.

Fix by:
- ensuring that no vcpus are installed when KVM_CREATE_IRQCHIP is called
- ensuring that a vcpu has an apic if it is installed after KVM_CREATE_IRQCHIP

This is somewhat long winded because vcpu->arch.apic is created without
kvm->lock held.

Based on earlier patch by Michael Ellerman.

Signed-off-by: default avatarMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent 4cee4798

arch/ia64/kvm/kvm-ia64.c

+5 −0
Original line number Diff line number Diff line
@@ -1172,6 +1172,11 @@ static enum hrtimer_restart hlt_timer_fn(struct hrtimer *data) 


#define PALE_RESET_ENTRY    0x80000000ffffffb0UL



bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)

{

	return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);

}



int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)

{

	struct kvm_vcpu *v;

arch/x86/kvm/x86.c

+8 −0
Original line number Diff line number Diff line
@@ -3199,6 +3199,9 @@ long kvm_arch_vm_ioctl(struct file *filp, 
		r = -EEXIST;

		if (kvm->arch.vpic)

			goto create_irqchip_unlock;

		r = -EINVAL;

		if (atomic_read(&kvm->online_vcpus))

			goto create_irqchip_unlock;

		r = -ENOMEM;

		vpic = kvm_create_pic(kvm);

		if (vpic) {
@@ -6107,6 +6110,11 @@ void kvm_arch_check_processor_compat(void *rtn) 
	kvm_x86_ops->check_processor_compatibility(rtn);

}



bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)

{

	return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);

}



int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)

{

	struct page *page;

include/linux/kvm_host.h

+7 −0
Original line number Diff line number Diff line
@@ -805,6 +805,13 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu) 
{

	return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;

}



bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);



#else



static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }



#endif



#ifdef __KVM_HAVE_DEVICE_ASSIGNMENT

virt/kvm/kvm_main.c

+4 −0
Original line number Diff line number Diff line
@@ -1651,6 +1651,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id) 
		goto vcpu_destroy;



	mutex_lock(&kvm->lock);

	if (!kvm_vcpu_compatible(vcpu)) {

		r = -EINVAL;

		goto unlock_vcpu_destroy;

	}

	if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {

		r = -EINVAL;

		goto unlock_vcpu_destroy;