KVM: Properly lock PIT creation

Otherwise, two threads can create a PIT in parallel and cause a memory leak.

Signed-off-by: Avi Kivity <avi@redhat.com>

2 files changed, 6 insertions, 2 deletions

diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 528daadeba49..69d1bbff3fd3 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -548,9 +548,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm)
         if (!pit)
                 return NULL;
 
-        mutex_lock(&kvm->lock);
         pit->irq_source_id = kvm_request_irq_source_id(kvm);
-        mutex_unlock(&kvm->lock);
         if (pit->irq_source_id < 0) {
                 kfree(pit);
                 return NULL;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index a1f14611f4b9..6fbc34603375 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1837,10 +1837,16 @@ long kvm_arch_vm_ioctl(struct file *filp,
                         goto out;
                 break;
         case KVM_CREATE_PIT:
+                mutex_lock(&kvm->lock);
+                r = -EEXIST;
+                if (kvm->arch.vpit)
+                        goto create_pit_unlock;
                 r = -ENOMEM;
                 kvm->arch.vpit = kvm_create_pit(kvm);
                 if (kvm->arch.vpit)
                         r = 0;
+        create_pit_unlock:
+                mutex_unlock(&kvm->lock);
                 break;
         case KVM_IRQ_LINE: {
                 struct kvm_irq_level irq_event;