oss-sec mailing list archives

kernel: kvm: pit timer with no irqchip crashes the system


From: Petr Matousek <pmatouse () redhat com>
Date: Wed, 21 Dec 2011 23:12:10 +0100

User space may create the PIT and forget about setting up the irqchips.
In that case, firing PIT IRQs will crash the host:

BUG: unable to handle kernel NULL pointer dereference at
0000000000000128
IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
...
Call Trace:
 [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
 [<ffffffff81071431>] process_one_work+0x111/0x4d0
 [<ffffffff81071bb2>] worker_thread+0x152/0x340
 [<ffffffff81075c8e>] kthread+0x7e/0x90
 [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10

Reference:
http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
https://bugzilla.redhat.com/show_bug.cgi?id=769721

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team


Current thread: