--- /dev/null
+From 7cae2bedcbd4680b155999655e49c27b9cf020fa Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Wed, 14 Oct 2015 19:33:09 -0300
+Subject: KVM: x86: move steal time initialization to vcpu entry time
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 7cae2bedcbd4680b155999655e49c27b9cf020fa upstream.
+
+As reported at https://bugs.launchpad.net/qemu/+bug/1494350,
+it is possible to have vcpu->arch.st.last_steal initialized
+from a thread other than vcpu thread, say the iothread, via
+KVM_SET_MSRS.
+
+Which can cause an overflow later (when subtracting from vcpu threads
+sched_info.run_delay).
+
+To avoid that, move steal time accumulation to vcpu entry time,
+before copying steal time data to guest.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Reviewed-by: David Matlack <dmatlack@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1941,6 +1941,8 @@ static void accumulate_steal_time(struct
+
+ static void record_steal_time(struct kvm_vcpu *vcpu)
+ {
++ accumulate_steal_time(vcpu);
++
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
+@@ -2074,12 +2076,6 @@ int kvm_set_msr_common(struct kvm_vcpu *
+ if (!(data & KVM_MSR_ENABLED))
+ break;
+
+- vcpu->arch.st.last_steal = current->sched_info.run_delay;
+-
+- preempt_disable();
+- accumulate_steal_time(vcpu);
+- preempt_enable();
+-
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+
+ break;
+@@ -2758,7 +2754,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu
+ vcpu->cpu = cpu;
+ }
+
+- accumulate_steal_time(vcpu);
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+ }
+