Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1945947AbbEVJ3F (ORCPT ); Fri, 22 May 2015 05:29:05 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:35025 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757082AbbEVI71 (ORCPT ); Fri, 22 May 2015 04:59:27 -0400 From: Luis Henriques To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Marc Zyngier , Shannon Zhao , Luis Henriques Subject: [PATCH 3.16.y-ckt 051/129] KVM: ARM: vgic: plug irq injection race Date: Fri, 22 May 2015 09:57:16 +0100 Message-Id: <1432285114-9254-52-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1432285114-9254-1-git-send-email-luis.henriques@canonical.com> References: <1432285114-9254-1-git-send-email-luis.henriques@canonical.com> X-Extended-Stable: 3.16 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1809 Lines: 47 3.16.7-ckt12 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Marc Zyngier commit 71afaba4a2e98bb7bdeba5078370ab43d46e67a1 upstream. As it stands, nothing prevents userspace from injecting an interrupt before the guest's GIC is actually initialized. This goes unnoticed so far (as everything is pretty much statically allocated), but ends up exploding in a spectacular way once we switch to a more dynamic allocation (the GIC data structure isn't there yet). The fix is to test for the "ready" flag in the VGIC distributor before trying to inject the interrupt. Note that in order to avoid breaking userspace, we have to ignore what is essentially an error. Signed-off-by: Marc Zyngier Acked-by: Christoffer Dall Signed-off-by: Shannon Zhao [ luis: backported to 3.16: used shannon's backport to 3.14 ] Signed-off-by: Luis Henriques --- virt/kvm/arm/vgic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c index 98160610fe56..b224b729cd0f 100644 --- a/virt/kvm/arm/vgic.c +++ b/virt/kvm/arm/vgic.c @@ -1387,7 +1387,8 @@ out: int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int irq_num, bool level) { - if (vgic_update_irq_state(kvm, cpuid, irq_num, level)) + if (likely(vgic_initialized(kvm)) && + vgic_update_irq_state(kvm, cpuid, irq_num, level)) vgic_kick_vcpus(kvm); return 0; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/