KVM: Ensure all vcpus are consistent with in-kernel irqchip settings

BugLink: http://bugs.launchpad.net/bugs/971685

CVE-2012-1601

If some vcpus are created before KVM_CREATE_IRQCHIP, then
irqchip_in_kernel() and vcpu->arch.apic will be inconsistent, leading
to potential NULL pointer dereferences.

Fix by:
- ensuring that no vcpus are installed when KVM_CREATE_IRQCHIP is called
- ensuring that a vcpu has an apic if it is installed after KVM_CREATE_IRQCHIP

This is somewhat long winded because vcpu->arch.apic is created without
kvm->lock held.

Based on earlier patch by Michael Ellerman.

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Avi Kivity <avi@redhat.com>
(cherry picked from commit 3e515705a1f46beb1c942bb8043c16f8ac7b1e9e)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Herton Krzesinski <herton.krzesinski@canonical.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7d6b8e3c237..f9013d11c57 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1618,6 +1618,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
                 goto vcpu_destroy;
 
         mutex_lock(&kvm->lock);
+        if (!kvm_vcpu_compatible(vcpu)) {
+                r = -EINVAL;
+                goto unlock_vcpu_destroy;
+        }
         if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
                 r = -EINVAL;
                 goto unlock_vcpu_destroy;