Commit 2bb27455 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Kleber Sacilotto de Souza

KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock

BugLink: https://bugs.launchpad.net/bugs/1838467

commit 250715a6 upstream.

The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.

Testcase:

    #include <pthread.h>
    #include <linux/kvm.h>
    #include <fcntl.h>
    #include <sys/ioctl.h>
    #include <stdint.h>
    #include <string.h>
    #include <stdlib.h>
    #include <sys/syscall.h>
    #include <unistd.h>

    long r[23];

    void* thr1(void* arg)
    {
        struct kvm_pit_config pitcfg = { .flags = 4 };
        switch ((long)arg) {
        case 0: r[2]  = open("/dev/kvm", O_RDONLY|O_ASYNC);    break;
        case 1: r[3]  = ioctl(r[2], KVM_CREATE_VM, 0);         break;
        case 2: r[4]  = ioctl(r[3], KVM_CREATE_IRQCHIP, 0);    break;
        case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
        }
        return 0;
    }

    int main(int argc, char **argv)
    {
        long i;
        pthread_t th[4];

        memset(r, -1, sizeof(r));
        for (i = 0; i < 4; i++) {
            pthread_create(&th[i], 0, thr, (void*)i);
            if (argc > 1 && rand()%2) usleep(rand()%1000);
        }
        usleep(20000);
        return 0;
    }
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
Signed-off-by: default avatarZubin Mithra <zsm@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarConnor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
parent 1abcea3f
...@@ -678,7 +678,6 @@ static const struct kvm_io_device_ops speaker_dev_ops = { ...@@ -678,7 +678,6 @@ static const struct kvm_io_device_ops speaker_dev_ops = {
.write = speaker_ioport_write, .write = speaker_ioport_write,
}; };
/* Caller must hold slots_lock */
struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
{ {
struct kvm_pit *pit; struct kvm_pit *pit;
...@@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) ...@@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
pit->mask_notifier.func = pit_mask_notifer; pit->mask_notifier.func = pit_mask_notifer;
kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier); kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
mutex_lock(&kvm->slots_lock);
kvm_iodevice_init(&pit->dev, &pit_dev_ops); kvm_iodevice_init(&pit->dev, &pit_dev_ops);
ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS, ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS,
KVM_PIT_MEM_LENGTH, &pit->dev); KVM_PIT_MEM_LENGTH, &pit->dev);
...@@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) ...@@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
if (ret < 0) if (ret < 0)
goto fail_unregister; goto fail_unregister;
} }
mutex_unlock(&kvm->slots_lock);
return pit; return pit;
fail_unregister: fail_unregister:
kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev); kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev);
fail: fail:
mutex_unlock(&kvm->slots_lock);
kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier); kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier); kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier);
kvm_free_irq_source_id(kvm, pit->irq_source_id); kvm_free_irq_source_id(kvm, pit->irq_source_id);
......
...@@ -3990,7 +3990,7 @@ long kvm_arch_vm_ioctl(struct file *filp, ...@@ -3990,7 +3990,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
sizeof(struct kvm_pit_config))) sizeof(struct kvm_pit_config)))
goto out; goto out;
create_pit: create_pit:
mutex_lock(&kvm->slots_lock); mutex_lock(&kvm->lock);
r = -EEXIST; r = -EEXIST;
if (kvm->arch.vpit) if (kvm->arch.vpit)
goto create_pit_unlock; goto create_pit_unlock;
...@@ -3999,7 +3999,7 @@ long kvm_arch_vm_ioctl(struct file *filp, ...@@ -3999,7 +3999,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
if (kvm->arch.vpit) if (kvm->arch.vpit)
r = 0; r = 0;
create_pit_unlock: create_pit_unlock:
mutex_unlock(&kvm->slots_lock); mutex_unlock(&kvm->lock);
break; break;
case KVM_GET_IRQCHIP: { case KVM_GET_IRQCHIP: {
/* 0: PIC master, 1: PIC slave, 2: IOAPIC */ /* 0: PIC master, 1: PIC slave, 2: IOAPIC */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment