leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
250715a617
linux/arch/x86
History
Paolo Bonzini 250715a617 KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock 
The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.

Testcase:

    #include <pthread.h>
    #include <linux/kvm.h>
    #include <fcntl.h>
    #include <sys/ioctl.h>
    #include <stdint.h>
    #include <string.h>
    #include <stdlib.h>
    #include <sys/syscall.h>
    #include <unistd.h>

    long r[23];

    void* thr1(void* arg)
    {
        struct kvm_pit_config pitcfg = { .flags = 4 };
        switch ((long)arg) {
        case 0: r[2]  = open("/dev/kvm", O_RDONLY|O_ASYNC);    break;
        case 1: r[3]  = ioctl(r[2], KVM_CREATE_VM, 0);         break;
        case 2: r[4]  = ioctl(r[3], KVM_CREATE_IRQCHIP, 0);    break;
        case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
        }
        return 0;
    }

    int main(int argc, char **argv)
    {
        long i;
        pthread_t th[4];

        memset(r, -1, sizeof(r));
        for (i = 0; i < 4; i++) {
            pthread_create(&th[i], 0, thr, (void*)i);
            if (argc > 1 && rand()%2) usleep(rand()%1000);
        }
        usleep(20000);
        return 0;
    }

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2016-06-03 15:28:19 +02:00
..
boot Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2016-05-26 22:01:22 -07:00
configs arch/defconfig: remove CONFIG_RESOURCE_COUNTERS 2016-05-23 17:04:14 -07:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-05-20 10:25:16 -07:00
entry Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2016-05-26 22:01:22 -07:00
events perf/x86/intel/p4: Trival indentation fix, remove space 2016-05-20 09:18:22 +02:00
ia32 mm: remove more IS_ERR_VALUE abuses 2016-05-27 15:57:31 -07:00
include platform-drivers-x86 for 4.7-1 2016-05-27 13:56:02 -07:00
kernel Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-05-25 17:37:33 -07:00
kvm KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock 2016-06-03 15:28:19 +02:00
lguest x86/paravirt: Remove paravirt_enabled() 2016-04-22 10:29:07 +02:00
lib Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-05-16 15:15:17 -07:00
math-emu Merge branch 'x86-headers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-11-03 21:05:40 -08:00
mm Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-05-25 17:37:33 -07:00
net bpf, x86: add support for constant blinding 2016-05-16 13:49:32 -04:00
oprofile x86/cpufeature: Replace cpu_has_apic with boot_cpu_has() usage 2016-04-13 11:37:41 +02:00
pci xen: bug fixes for 4.7-rc0 2016-05-24 10:22:34 -07:00
platform Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-05-25 17:37:33 -07:00
power x86/cpufeature: Remove cpu_has_pse 2016-03-31 13:35:10 +02:00
purgatory kbuild: delete unnecessary "@:" 2016-04-20 10:36:57 +02:00
ras x86/RAS: Add SMCA support to AMD Error Injector 2016-05-12 09:08:23 +02:00
realmode kbuild: delete unnecessary "@:" 2016-04-20 10:36:57 +02:00
tools x86/KASLR: Clean up unused code from old 'run_size' and rename it to 'kernel_total_size' 2016-04-29 11:03:30 +02:00
um Merge branch 'for-linus-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml 2016-05-27 18:54:59 -07:00
video x86/video: Don't assume all FB devices are PCI devices 2016-03-15 11:08:26 +01:00
xen xen: bug fixes for 4.7-rc0 2016-05-24 10:22:34 -07:00
.gitignore
Kbuild perf/x86: Move perf_event.c ............... => x86/events/core.c 2016-02-09 10:23:49 +01:00
Kconfig x86 isa: add back X86_32 dependency on CONFIG_ISA 2016-05-21 10:25:19 -07:00
Kconfig.cpu x86/Kconfig/cpus: Fix/complete CPU type help texts 2015-10-21 11:12:56 +02:00
Kconfig.debug Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-15 09:32:27 -07:00
Makefile x86/init: Rename EBDA code file 2016-04-22 10:29:07 +02:00
Makefile_32.cpu
Makefile.um