KVM: x86: Reload pit counters for all channels when restoring state
authorAndrew Honig <ahonig@google.com>
Wed, 18 Nov 2015 22:50:23 +0000 (14:50 -0800)
committerWilly Tarreau <w@1wt.eu>
Fri, 29 Jan 2016 21:12:59 +0000 (22:12 +0100)
commit4d1805f9990db66894c32bc12ec8d61778d53533
tree953308f988641bf9949052ba85868a1c4ba8eb8c
parentc7bde2000d1dfadb741c10925cea49e8ab1dc039
KVM: x86: Reload pit counters for all channels when restoring state

commit 0185604c2d82c560dab2f2933a18f797e74ab5a8 upstream.

Currently if userspace restores the pit counters with a count of 0
on channels 1 or 2 and the guest attempts to read the count on those
channels, then KVM will perform a mod of 0 and crash.  This will ensure
that 0 values are converted to 65536 as per the spec.

This is CVE-2015-7513.

Signed-off-by: Andy Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit 08b8d1a6ccdefd3d517d04c472b7f42f51b3059b)
Signed-off-by: Willy Tarreau <w@1wt.eu>
arch/x86/kvm/x86.c