4.4-stable patches

added patches:
	kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch

diff --git a/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch b/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch
new file mode 100644 (file)
index 0000000..904a9e1
--- /dev/null
+++ b/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch
@@ -0,0 +1,122 @@
+From 250715a6171a076748be8ab88b274e72f0cfb435 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 1 Jun 2016 14:09:24 +0200
+Subject: KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream.
+
+The syzkaller folks reported a NULL pointer dereference that seems
+to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
+The former takes kvm->lock (except when registering the devices,
+which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
+Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
+
+Testcase:
+
+    #include <pthread.h>
+    #include <linux/kvm.h>
+    #include <fcntl.h>
+    #include <sys/ioctl.h>
+    #include <stdint.h>
+    #include <string.h>
+    #include <stdlib.h>
+    #include <sys/syscall.h>
+    #include <unistd.h>
+
+    long r[23];
+
+    void* thr1(void* arg)
+    {
+        struct kvm_pit_config pitcfg = { .flags = 4 };
+        switch ((long)arg) {
+        case 0: r[2]  = open("/dev/kvm", O_RDONLY|O_ASYNC);    break;
+        case 1: r[3]  = ioctl(r[2], KVM_CREATE_VM, 0);         break;
+        case 2: r[4]  = ioctl(r[3], KVM_CREATE_IRQCHIP, 0);    break;
+        case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
+        }
+        return 0;
+    }
+
+    int main(int argc, char **argv)
+    {
+        long i;
+        pthread_t th[4];
+
+        memset(r, -1, sizeof(r));
+        for (i = 0; i < 4; i++) {
+            pthread_create(&th[i], 0, thr, (void*)i);
+            if (argc > 1 && rand()%2) usleep(rand()%1000);
+        }
+        usleep(20000);
+        return 0;
+    }
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Zubin Mithra <zsm@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/i8254.c |    5 +++--
+ arch/x86/kvm/x86.c   |    4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -678,7 +678,6 @@ static const struct kvm_io_device_ops sp
+       .write    = speaker_ioport_write,
+ };
+ 
+-/* Caller must hold slots_lock */
+ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
+ {
+       struct kvm_pit *pit;
+@@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kv
+       pit->mask_notifier.func = pit_mask_notifer;
+       kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
+ 
++      mutex_lock(&kvm->slots_lock);
+       kvm_iodevice_init(&pit->dev, &pit_dev_ops);
+       ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS,
+                                     KVM_PIT_MEM_LENGTH, &pit->dev);
+@@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kv
+               if (ret < 0)
+                       goto fail_unregister;
+       }
++      mutex_unlock(&kvm->slots_lock);
+ 
+       return pit;
+ 
+ fail_unregister:
+       kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev);
+-
+ fail:
++      mutex_unlock(&kvm->slots_lock);
+       kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
+       kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier);
+       kvm_free_irq_source_id(kvm, pit->irq_source_id);
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3867,7 +3867,7 @@ long kvm_arch_vm_ioctl(struct file *filp
+                                  sizeof(struct kvm_pit_config)))
+                       goto out;
+       create_pit:
+-              mutex_lock(&kvm->slots_lock);
++              mutex_lock(&kvm->lock);
+               r = -EEXIST;
+               if (kvm->arch.vpit)
+                       goto create_pit_unlock;
+@@ -3876,7 +3876,7 @@ long kvm_arch_vm_ioctl(struct file *filp
+               if (kvm->arch.vpit)
+                       r = 0;
+       create_pit_unlock:
+-              mutex_unlock(&kvm->slots_lock);
++              mutex_unlock(&kvm->lock);
+               break;
+       case KVM_GET_IRQCHIP: {
+               /* 0: PIC master, 1: PIC slave, 2: IOAPIC */

diff --git a/queue-4.4/series b/queue-4.4/series
index 49182424ebfcb1068d4762b5f1e69ba142d5ecb4..136b386def7fe214ac07fb8c50cb7e2e066ce9e7 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -37,3 +37,4 @@ arc-hide-unused-function-unw_hdr_alloc.patch
 s390-fix-stfle-zero-padding.patch
 s390-qdio-re-initialize-tiqdio-list-entries.patch
 s390-qdio-don-t-touch-the-dsci-in-tiqdio_add_input_queues.patch
+kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch