From 053ccd1205c137aa1a91701c806e03f583f9b0cb Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 18 Jul 2019 05:53:52 +0900 Subject: [PATCH] 4.4-stable patches added patches: kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch --- ...te_pit-kvm_create_pit2-with-kvm-lock.patch | 122 ++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 123 insertions(+) create mode 100644 queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch diff --git a/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch b/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch new file mode 100644 index 00000000000..904a9e11e7d --- /dev/null +++ b/queue-4.4/kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch @@ -0,0 +1,122 @@ +From 250715a6171a076748be8ab88b274e72f0cfb435 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 1 Jun 2016 14:09:24 +0200 +Subject: KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Bonzini + +commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream. + +The syzkaller folks reported a NULL pointer dereference that seems +to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2. +The former takes kvm->lock (except when registering the devices, +which needs kvm->slots_lock); the latter takes kvm->slots_lock only. +Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP. + +Testcase: + + #include + #include + #include + #include + #include + #include + #include + #include + #include + + long r[23]; + + void* thr1(void* arg) + { + struct kvm_pit_config pitcfg = { .flags = 4 }; + switch ((long)arg) { + case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break; + case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break; + case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break; + case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break; + } + return 0; + } + + int main(int argc, char **argv) + { + long i; + pthread_t th[4]; + + memset(r, -1, sizeof(r)); + for (i = 0; i < 4; i++) { + pthread_create(&th[i], 0, thr, (void*)i); + if (argc > 1 && rand()%2) usleep(rand()%1000); + } + usleep(20000); + return 0; + } + +Reported-by: Dmitry Vyukov +Signed-off-by: Paolo Bonzini +Signed-off-by: Radim Krčmář +Signed-off-by: Zubin Mithra +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/i8254.c | 5 +++-- + arch/x86/kvm/x86.c | 4 ++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -678,7 +678,6 @@ static const struct kvm_io_device_ops sp + .write = speaker_ioport_write, + }; + +-/* Caller must hold slots_lock */ + struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) + { + struct kvm_pit *pit; +@@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kv + pit->mask_notifier.func = pit_mask_notifer; + kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier); + ++ mutex_lock(&kvm->slots_lock); + kvm_iodevice_init(&pit->dev, &pit_dev_ops); + ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS, + KVM_PIT_MEM_LENGTH, &pit->dev); +@@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kv + if (ret < 0) + goto fail_unregister; + } ++ mutex_unlock(&kvm->slots_lock); + + return pit; + + fail_unregister: + kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev); +- + fail: ++ mutex_unlock(&kvm->slots_lock); + kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier); + kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier); + kvm_free_irq_source_id(kvm, pit->irq_source_id); +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3867,7 +3867,7 @@ long kvm_arch_vm_ioctl(struct file *filp + sizeof(struct kvm_pit_config))) + goto out; + create_pit: +- mutex_lock(&kvm->slots_lock); ++ mutex_lock(&kvm->lock); + r = -EEXIST; + if (kvm->arch.vpit) + goto create_pit_unlock; +@@ -3876,7 +3876,7 @@ long kvm_arch_vm_ioctl(struct file *filp + if (kvm->arch.vpit) + r = 0; + create_pit_unlock: +- mutex_unlock(&kvm->slots_lock); ++ mutex_unlock(&kvm->lock); + break; + case KVM_GET_IRQCHIP: { + /* 0: PIC master, 1: PIC slave, 2: IOAPIC */ diff --git a/queue-4.4/series b/queue-4.4/series index 49182424ebf..136b386def7 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -37,3 +37,4 @@ arc-hide-unused-function-unw_hdr_alloc.patch s390-fix-stfle-zero-padding.patch s390-qdio-re-initialize-tiqdio-list-entries.patch s390-qdio-don-t-touch-the-dsci-in-tiqdio_add_input_queues.patch +kvm-x86-protect-kvm_create_pit-kvm_create_pit2-with-kvm-lock.patch -- 2.47.3