KVM: ARM: vgic: plug irq injection race

commit 71afaba4a2e98bb7bdeba5078370ab43d46e67a1 upstream.

[Since we don't backport commit 227844f (arm/arm64: KVM: Rename irq_state
to irq_pending) for linux-3.14.y, here we still use vgic_update_irq_state
instead of vgic_update_irq_pending.]

As it stands, nothing prevents userspace from injecting an interrupt
before the guest's GIC is actually initialized.

This goes unnoticed so far (as everything is pretty much statically
allocated), but ends up exploding in a spectacular way once we switch
to a more dynamic allocation (the GIC data structure isn't there yet).

The fix is to test for the "ready" flag in the VGIC distributor before
trying to inject the interrupt. Note that in order to avoid breaking
userspace, we have to ignore what is essentially an error.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 1316e558db64d84ff5f3a38a5388758395f3926e..21873187b51330e9b6ecc5a560c69799e06f4df6 100644 (file)
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1387,7 +1387,8 @@ static bool vgic_update_irq_state(struct kvm *kvm, int cpuid,
 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int irq_num,
                        bool level)
 {
-       if (vgic_update_irq_state(kvm, cpuid, irq_num, level))
+       if (likely(vgic_initialized(kvm)) &&
+           vgic_update_irq_state(kvm, cpuid, irq_num, level))
                vgic_kick_vcpus(kvm);
 
        return 0;