| Message ID | 20180815203019.214901-1-pshier@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: Remove CREATE_IRQCHIP/SET_PIT2 race | expand |
On Wed, 2018-08-15 at 13:30 -0700, Peter Shier wrote: > From: Steve Rutherford <srutherford@google.com> > > Fixes a NULL pointer dereference, caused by the PIT firing an interrupt > before the interrupt table has been initialized. > > SET_PIT2 can race with the creation of the IRQchip. In particular, > if SET_PIT2 is called with a low PIT timer period (after the creation of > the IOAPIC, but before the instantiation of the irq routes), the PIT can > fire an interrupt at an uninitialized table. > > Signed-off-by: Steve Rutherford <srutherford@google.com> > Signed-off-by: Peter Shier <pshier@google.com> > Signed-off-by: Jim Mattson <jmattson@google.com> > --- > arch/x86/kvm/x86.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index 3c83711c0ebe1..953ac519fb984 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -4493,10 +4493,13 @@ long kvm_arch_vm_ioctl(struct file *filp, > r = -EFAULT; > if (copy_from_user(&u.ps, argp, sizeof u.ps)) > goto out; > + mutex_lock(&kvm->lock); > r = -ENXIO; > if (!kvm->arch.vpit) > - goto out; > + goto set_pit_out; > r = kvm_vm_ioctl_set_pit(kvm, &u.ps); > +set_pit_out: > + mutex_unlock(&kvm->lock); > break; How about doing it this way instead: mutex_lock(&kvm->lock); r = -ENXIO; if (kvm->arch.vpit) r = kvm_vm_ioctl_set_pit(kvm, &u.ps); mutex_unlock(&kvm->lock); break; ? This would avoid using a 'goto' + 2 lines shorter. > } > case KVM_GET_PIT2: { > @@ -4516,10 +4519,13 @@ long kvm_arch_vm_ioctl(struct file *filp, > r = -EFAULT; > if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) > goto out; > + mutex_lock(&kvm->lock); > r = -ENXIO; > if (!kvm->arch.vpit) > - goto out; > + goto set_pit2_out; > r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2); > +set_pit2_out: > + mutex_unlock(&kvm->lock); > break; ... same here. > } > case KVM_REINJECT_CONTROL: { Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3c83711c0ebe1..953ac519fb984 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4493,10 +4493,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps, argp, sizeof u.ps)) goto out; + mutex_lock(&kvm->lock); r = -ENXIO; if (!kvm->arch.vpit) - goto out; + goto set_pit_out; r = kvm_vm_ioctl_set_pit(kvm, &u.ps); +set_pit_out: + mutex_unlock(&kvm->lock); break; } case KVM_GET_PIT2: { @@ -4516,10 +4519,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) goto out; + mutex_lock(&kvm->lock); r = -ENXIO; if (!kvm->arch.vpit) - goto out; + goto set_pit2_out; r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2); +set_pit2_out: + mutex_unlock(&kvm->lock); break; } case KVM_REINJECT_CONTROL: {