mirror of
https://github.com/FEX-Emu/linux.git
synced 2025-01-02 23:30:04 +00:00
b963a22e6d
Under guest controllable circumstances apic_get_tmcct will execute a divide by zero and cause a crash. If the guest cpuid support tsc deadline timers and performs the following sequence of requests the host will crash. - Set the mode to periodic - Set the TMICT to 0 - Set the mode bits to 11 (neither periodic, nor one shot, nor tsc deadline) - Set the TMICT to non-zero. Then the lapic_timer.period will be 0, but the TMICT will not be. If the guest then reads from the TMCCT then the host will perform a divide by 0. This patch ensures that if the lapic_timer.period is 0, then the division does not occur. Reported-by: Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|---|---|---|
| .. | ||
| cpuid.c | ||
| cpuid.h | ||
| emulate.c | ||
| i8254.c | ||
| i8254.h | ||
| i8259.c | ||
| irq.c | ||
| irq.h | ||
| Kconfig | ||
| kvm_cache_regs.h | ||
| lapic.c | ||
| lapic.h | ||
| Makefile | ||
| mmu_audit.c | ||
| mmu.c | ||
| mmu.h | ||
| mmutrace.h | ||
| paging_tmpl.h | ||
| pmu.c | ||
| svm.c | ||
| trace.h | ||
| tss.h | ||
| vmx.c | ||
| x86.c | ||
| x86.h | ||