KVM: x86: Reload pit counters for all channels when restoring state
authorAndrew Honig <ahonig@google.com>
Wed, 18 Nov 2015 22:50:23 +0000 (14:50 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Fri, 22 Jan 2016 21:40:09 +0000 (21:40 +0000)
commit08b8d1a6ccdefd3d517d04c472b7f42f51b3059b
treecdb4d4e5846a740bf32cffd38b8f7f5563db18fb
parentccf8b3948a05d0ac28fecfefde3ec9e75d43a1bd
KVM: x86: Reload pit counters for all channels when restoring state

commit 0185604c2d82c560dab2f2933a18f797e74ab5a8 upstream.

Currently if userspace restores the pit counters with a count of 0
on channels 1 or 2 and the guest attempts to read the count on those
channels, then KVM will perform a mod of 0 and crash.  This will ensure
that 0 values are converted to 65536 as per the spec.

This is CVE-2015-7513.

Signed-off-by: Andy Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
arch/x86/kvm/x86.c