summaryrefslogtreecommitdiffstats
path: root/virt/kvm/iommu.c
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2016-06-01 14:09:24 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-07-21 09:07:16 +0200
commitc02686acab234a36aeb678a040d8aee0c4a07845 (patch)
tree8f2108c9da0f29f112c8dcbae9ad243d7524b092 /virt/kvm/iommu.c
parent970871c643fc8ba2b0eabe740303c8a155b35e22 (diff)
downloadlinux-stable-c02686acab234a36aeb678a040d8aee0c4a07845.tar.gz
linux-stable-c02686acab234a36aeb678a040d8aee0c4a07845.tar.bz2
linux-stable-c02686acab234a36aeb678a040d8aee0c4a07845.zip
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream. The syzkaller folks reported a NULL pointer dereference that seems to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2. The former takes kvm->lock (except when registering the devices, which needs kvm->slots_lock); the latter takes kvm->slots_lock only. Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP. Testcase: #include <pthread.h> #include <linux/kvm.h> #include <fcntl.h> #include <sys/ioctl.h> #include <stdint.h> #include <string.h> #include <stdlib.h> #include <sys/syscall.h> #include <unistd.h> long r[23]; void* thr1(void* arg) { struct kvm_pit_config pitcfg = { .flags = 4 }; switch ((long)arg) { case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break; case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break; case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break; case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break; } return 0; } int main(int argc, char **argv) { long i; pthread_t th[4]; memset(r, -1, sizeof(r)); for (i = 0; i < 4; i++) { pthread_create(&th[i], 0, thr, (void*)i); if (argc > 1 && rand()%2) usleep(rand()%1000); } usleep(20000); return 0; } Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Zubin Mithra <zsm@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'virt/kvm/iommu.c')
0 files changed, 0 insertions, 0 deletions