Commit 449a72277a5dc2a12cd114af3be81a56ad10cbd1
Committed by
Greg Kroah-Hartman
1 parent
fb07a1411e
Exists in
ti-linux-3.14.y
and in
2 other branches
KVM: x86: Improve thread safety in pit
commit 2febc839133280d5a5e8e1179c94ea674489dae2 upstream. There's a race condition in the PIT emulation code in KVM. In __kvm_migrate_pit_timer the pit_timer object is accessed without synchronization. If the race condition occurs at the wrong time this can crash the host kernel. This fixes CVE-2014-3611. Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 2 additions and 0 deletions Side-by-side Diff
arch/x86/kvm/i8254.c
... | ... | @@ -262,8 +262,10 @@ |
262 | 262 | return; |
263 | 263 | |
264 | 264 | timer = &pit->pit_state.timer; |
265 | + mutex_lock(&pit->pit_state.lock); | |
265 | 266 | if (hrtimer_cancel(timer)) |
266 | 267 | hrtimer_start_expires(timer, HRTIMER_MODE_ABS); |
268 | + mutex_unlock(&pit->pit_state.lock); | |
267 | 269 | } |
268 | 270 | |
269 | 271 | static void destroy_pit_timer(struct kvm_pit *pit) |