KVM: x86: Improve thread safety in pit

There's a race condition in the PIT emulation code in KVM. In __kvm_migrate_pit_timer the pit_timer object is accessed without synchronization. If the race condition occurs at the wrong time this can crash the host kernel. This fixes CVE-2014-3611. Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

KVM: x86: Improve thread safety in pit
There's a race condition in the PIT emulation code in KVM. In __kvm_migrate_pit_timer the pit_timer object is accessed without synchronization. If the race condition occurs at the wrong time this can crash the host kernel. This fixes CVE-2014-3611. Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Andy Honig · Paolo Bonzini · Eric Lee · Eric Lee · Eric Lee · Eric Lee
1 parent 8b3c3104c3
Showing 1 changed file with 2 additions and 0 deletions Side-by-side Diff
arch/x86/kvm/i8254.c
@@ -262,8 +262,10 @@
 		return;
  
 	timer = &pit->pit_state.timer;
+	mutex_lock(&pit->pit_state.lock);
 	if (hrtimer_cancel(timer))
 		hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
+	mutex_unlock(&pit->pit_state.lock);
 }
  
 static void destroy_pit_timer(struct kvm_pit *pit)
...	...	@@ -262,8 +262,10 @@
262	262	return;
263	263
264	264	timer = &pit->pit_state.timer;
	265	+ mutex_lock(&pit->pit_state.lock);
265	266	if (hrtimer_cancel(timer))
266	267	hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
	268	+ mutex_unlock(&pit->pit_state.lock);
267	269	}
268	270
269	271	static void destroy_pit_timer(struct kvm_pit *pit)