Paolo Bonzini
c02686acab
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
...
commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream.
The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
Testcase:
#include <pthread.h>
#include <linux/kvm.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
long r[23];
void* thr1(void* arg)
{
struct kvm_pit_config pitcfg = { .flags = 4 };
switch ((long)arg) {
case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break;
case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break;
case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break;
case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
}
return 0;
}
int main(int argc, char **argv)
{
long i;
pthread_t th[4];
memset(r, -1, sizeof(r));
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (argc > 1 && rand()%2) usleep(rand()%1000);
}
usleep(20000);
return 0;
}
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Zubin Mithra <zsm@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-21 09:07:16 +02:00
..
2019-02-20 10:13:22 +01:00
2019-07-21 09:07:14 +02:00
2019-07-21 09:07:13 +02:00
2019-07-10 09:56:44 +02:00
2016-10-07 15:23:45 +02:00
2017-12-20 10:05:00 +01:00
2017-03-31 09:49:53 +02:00
2018-12-17 21:55:16 +01:00
2018-05-26 08:48:50 +02:00
2019-04-27 09:33:48 +02:00
2018-10-10 08:52:12 +02:00
2019-07-10 09:56:42 +02:00
2016-09-24 10:07:43 +02:00
2019-07-10 09:56:42 +02:00
2017-05-25 14:30:16 +02:00
2018-08-06 16:24:39 +02:00
2019-07-21 09:07:12 +02:00
2018-02-16 20:09:47 +01:00
2017-04-12 12:38:34 +02:00
2018-09-19 22:48:55 +02:00
2019-07-10 09:56:31 +02:00
2019-06-22 08:18:26 +02:00
2019-07-21 09:07:15 +02:00
2016-09-24 10:07:44 +02:00
2018-12-17 21:55:16 +01:00
2019-07-10 09:56:42 +02:00
2018-05-26 08:48:50 +02:00
2019-07-10 09:56:39 +02:00
2019-07-21 09:07:16 +02:00
2019-04-27 09:33:56 +02:00