2016-12-21 20:44 GMT+08:00 Radim Krčmář :
> 2016-12-20 19:59+0800, Wanpeng Li:
>> 2016-11-24 20:42 GMT+08:00 Radim Krčmář :
>>> 2016-11-23 22:58+0100, Paolo Bonzini:
On 23/11/2016 21:25, Radim Krčmář wrote:
> diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
> index 25810b
2016-12-20 19:59+0800, Wanpeng Li:
> 2016-11-24 20:42 GMT+08:00 Radim Krčmář :
>> 2016-11-23 22:58+0100, Paolo Bonzini:
>>> On 23/11/2016 21:25, Radim Krčmář wrote:
diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
index 25810b144b58..ddd63b8b176e 100644
--- a/arch/x86/k
2016-11-24 20:42 GMT+08:00 Radim Krčmář :
> 2016-11-23 22:58+0100, Paolo Bonzini:
>> On 23/11/2016 21:25, Radim Krčmář wrote:
>>> diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
>>> index 25810b144b58..ddd63b8b176e 100644
>>> --- a/arch/x86/kvm/irq_comm.c
>>> +++ b/arch/x86/kvm/irq_c
> Oops, I wrote the race with wrong IOCTL -- it should be KVM_IRQ_LINE.
>
> 1) set KVM_CAP_SPLIT_IRQCHIP (unlocks KVM_IRQ_LINE)
> a) call KVM_CREATE_IRQCHIP (creates routes while !kvm->arch.vpic)
> b) concurrently call KVM_IRQ_LINE for PIO routes (dereferences NULL)
>
> The problem is that we
2016-11-23 22:58+0100, Paolo Bonzini:
> On 23/11/2016 21:25, Radim Krčmář wrote:
>> diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
>> index 25810b144b58..ddd63b8b176e 100644
>> --- a/arch/x86/kvm/irq_comm.c
>> +++ b/arch/x86/kvm/irq_comm.c
>> @@ -41,6 +41,15 @@ static int kvm_set_pi
On 23/11/2016 21:25, Radim Krčmář wrote:
> diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
> index 25810b144b58..ddd63b8b176e 100644
> --- a/arch/x86/kvm/irq_comm.c
> +++ b/arch/x86/kvm/irq_comm.c
> @@ -41,6 +41,15 @@ static int kvm_set_pic_irq(struct
> kvm_kernel_irq_routing_entr
Split irqchip allows pic and ioapic routes to be used without them being
created, which results in NULL access. Check for NULL and avoid it.
(The setup is too racy for a nicer solutions.)
Found by syzkaller:
general protection fault: [#1] SMP DEBUG_PAGEALLOC KASAN
Dumping ftrace buffer:
7 matches
Mail list logo