From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, kvm@vger.kernel.org,
Marcelo Tosatti <mtosatti@redhat.com>,
Jan Kiszka <jan.kiszka@siemens.com>
Subject: [16/48] KVM: x86: Prevent starting PIT timers in the absence of irqchip support
Date: Mon, 16 Jan 2012 10:44:43 -0800 [thread overview]
Message-ID: <20120116184517.132382029@clark.kroah.org> (raw)
In-Reply-To: <20120116184527.GA11972@kroah.com>
3.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <jan.kiszka@siemens.com>
(cherry picked from commit 0924ab2cfa98b1ece26c033d696651fd62896c69)
User space may create the PIT and forgets about setting up the irqchips.
In that case, firing PIT IRQs will crash the host:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
...
Call Trace:
[<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
[<ffffffff81071431>] process_one_work+0x111/0x4d0
[<ffffffff81071bb2>] worker_thread+0x152/0x340
[<ffffffff81075c8e>] kthread+0x7e/0x90
[<ffffffff815a4474>] kernel_thread_helper+0x4/0x10
Prevent this by checking the irqchip mode before starting a timer. We
can't deny creating the PIT if the irqchips aren't set up yet as
current user land expects this order to work.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kvm/i8254.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -338,11 +338,15 @@ static enum hrtimer_restart pit_timer_fn
return HRTIMER_NORESTART;
}
-static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
+static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
{
+ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
struct kvm_timer *pt = &ps->pit_timer;
s64 interval;
+ if (!irqchip_in_kernel(kvm))
+ return;
+
interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
pr_debug("create pit timer, interval is %llu nsec\n", interval);
@@ -394,13 +398,13 @@ static void pit_load_count(struct kvm *k
/* FIXME: enhance mode 4 precision */
case 4:
if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
- create_pit_timer(ps, val, 0);
+ create_pit_timer(kvm, val, 0);
}
break;
case 2:
case 3:
if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
- create_pit_timer(ps, val, 1);
+ create_pit_timer(kvm, val, 1);
}
break;
default:
next prev parent reply other threads:[~2012-01-16 18:48 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-16 18:45 [00/48] 3.1.10-stable review Greg KH
2012-01-16 18:44 ` [01/48] mtdoops: fix the oops_page_used array size Greg KH
2012-01-16 18:44 ` [02/48] mtd: mtdoops: skip reading initially bad blocks Greg KH
2012-01-16 18:44 ` [03/48] mtd: mtd_blkdevs: dont increase open count on error path Greg KH
2012-01-16 18:44 ` [04/48] mtd: tests: stresstest: bail out if device has not enough eraseblocks Greg KH
2012-01-16 18:44 ` [05/48] drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range Greg KH
2012-01-16 18:44 ` [06/48] ext4: fix undefined behavior in ext4_fill_flex_info() Greg KH
2012-01-16 18:44 ` [07/48] ALSA: snd-usb-us122l: Delete calls to preempt_disable Greg KH
2012-01-16 18:44 ` [08/48] ALSA: HDA: Fix master control for Cirrus Logic 421X Greg KH
2012-01-16 18:44 ` [09/48] ALSA: HDA: Fix automute for Cirrus Logic 421x Greg KH
2012-01-16 18:44 ` [10/48] ALSA: ice1724 - Check for ac97 to avoid kernel oops Greg KH
2012-01-16 18:44 ` [11/48] ALSA: hda - Use auto-parser for HP laptops with cx20459 codec Greg KH
2012-01-16 18:44 ` [12/48] ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs Greg KH
2012-01-16 18:44 ` [13/48] ALSA: hda - Fix the detection of "Loopback Mixing" control for VIA codecs Greg KH
2012-01-16 18:44 ` [14/48] ALSA: hda - Fix the lost power-setup of seconary pins after PM resume Greg KH
2012-01-16 18:44 ` [15/48] KVM guest: prevent tracing recursion with kvmclock Greg KH
2012-01-16 18:44 ` Greg KH [this message]
2012-01-16 18:44 ` [17/48] KVM: Remove ability to assign a device without iommu support Greg KH
2012-01-16 18:44 ` [18/48] KVM: Device assignment permission checks Greg KH
2012-01-16 18:44 ` [19/48] [PATCH] ideapad: Check if acpi already handle backlight power to avoid a page fault Greg KH
2012-01-16 18:44 ` [20/48] drm/radeon/kms: workaround invalid AVI infoframe checksum issue Greg KH
2012-01-16 18:44 ` [21/48] drm/radeon/kms: disable writeback on pre-R300 asics Greg KH
2012-01-16 18:44 ` [22/48] radeon: Fix disabling PCI bus mastering on big endian hosts Greg KH
2012-01-16 18:44 ` [23/48] NFS: Retry mounting NFSROOT Greg KH
2012-01-16 18:44 ` [24/48] NFSv4.1: fix backchannel slotid off-by-one bug Greg KH
2012-01-16 18:44 ` [25/48] NFS - fix recent breakage to NFS error handling Greg KH
2012-01-16 18:44 ` [26/48] NFSv4: include bitmap in nfsv4 get acl data Greg KH
2012-01-16 18:44 ` [27/48] nfs: fix regression in handling of context= option in NFSv4 Greg KH
2012-01-16 18:44 ` [28/48] HID: bump maximum global item tag report size to 96 bytes Greg KH
2012-01-16 18:44 ` [29/48] HID: wiimote: Select INPUT_FF_MEMLESS Greg KH
2012-01-17 1:55 ` Paul Gortmaker
2012-01-17 6:37 ` David Herrmann
2012-01-17 8:33 ` Dan Carpenter
2012-01-17 17:09 ` Greg KH
2012-01-16 18:44 ` [30/48] UBI: fix missing scrub when there is a bit-flip Greg KH
2012-01-16 18:44 ` [31/48] UBI: fix use-after-free on error path Greg KH
2012-01-16 18:44 ` [32/48] PCI: Fix PCI_EXP_TYPE_RC_EC value Greg KH
2012-01-16 18:45 ` [33/48] PCI: msi: Disable msi interrupts when we initialize a pci device Greg KH
2012-01-16 18:45 ` [34/48] x86/PCI: Ignore CPU non-addressable _CRS reserved memory resources Greg KH
2012-01-16 18:45 ` [35/48] x86/PCI: amd: factor out MMCONFIG discovery Greg KH
2012-01-16 18:45 ` [36/48] x86/PCI: build amd_bus.o only when CONFIG_AMD_NB=y Greg KH
2012-01-16 18:45 ` [37/48] SCSI: mpt2sas: Release spinlock for the raid device list before blocking it Greg KH
2012-01-16 18:45 ` [38/48] SCSI: mpt2sas : Fix for memory allocation error for large host credits Greg KH
2012-01-16 18:45 ` [39/48] xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX Greg KH
2012-01-16 18:45 ` [40/48] md/raid1: perform bad-block tests for WriteMostly devices too Greg KH
2012-01-16 18:45 ` [41/48] ima: free duplicate measurement memory Greg KH
2012-01-16 18:45 ` [42/48] ima: fix invalid memory reference Greg KH
2012-01-16 18:45 ` [43/48] slub: fix a possible memleak in __slab_alloc() Greg KH
2012-01-16 18:45 ` [44/48] PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB Greg KH
2012-01-16 18:45 ` [45/48] rtl8192se: Fix BUG caused by failure to check skb allocation Greg KH
2012-01-16 18:45 ` [46/48] mac80211: fix rx->key NULL pointer dereference in promiscuous mode Greg KH
2012-01-16 18:45 ` [47/48] memcg: add mem_cgroup_replace_page_cache() to fix LRU issue Greg KH
2012-01-16 18:45 ` [48/48] x86: Fix mmap random address range Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120116184517.132382029@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=jan.kiszka@siemens.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtosatti@redhat.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®