Commit 2febc839 authored Aug 27, 2014 by Andy Honig Committed by Paolo Bonzini Oct 24, 2014

KVM: x86: Improve thread safety in pit



There's a race condition in the PIT emulation code in KVM.  In
__kvm_migrate_pit_timer the pit_timer object is accessed without
synchronization.  If the race condition occurs at the wrong time this
can crash the host kernel.

This fixes CVE-2014-3611.

Cc: stable@vger.kernel.org
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 8b3c3104

arch/x86/kvm/i8254.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
		return;

		timer = &pit->pit_state.timer;
		mutex_lock(&pit->pit_state.lock);
		if (hrtimer_cancel(timer))
		hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
		mutex_unlock(&pit->pit_state.lock);
		}

		static void destroy_pit_timer(struct kvm_pit *pit)

Admin message