Re: kernel: kvm: pit timer with no irqchip crashes the system

[Petr Matousek <pmatouse () redhat com>]

Sorry, I forgot to put "CVE Request" into the subject.

Petr

On Wed, Dec 21, 2011 at 11:12:10PM +0100, Petr Matousek wrote:
> User space may create the PIT and forget about setting up the irqchips.
> In that case, firing PIT IRQs will crash the host:
>
> BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000128
> IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
> ...
> Call Trace:
>  [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
>  [<ffffffff81071431>] process_one_work+0x111/0x4d0
>  [<ffffffff81071bb2>] worker_thread+0x152/0x340
>  [<ffffffff81075c8e>] kthread+0x7e/0x90
>  [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10
>
> Reference:
> http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
> https://bugzilla.redhat.com/show_bug.cgi?id=769721
>
> Thanks,
> -- 
> Petr Matousek / Red Hat Security Response Team

-- 
Petr Matousek / Red Hat Security Response Team