From 7412226eff8998c660109df536030f0fb1c8770e Mon Sep 17 00:00:00 2001
From: Glauber Costa <glommer@redhat.com>
Date: Mon, 17 May 2010 16:02:17 -0300
Subject: [PATCH] KVM: Fix wallclock version writing race

RH-Author: Glauber Costa <glommer@redhat.com>
Message-id: <1274112137-23293-1-git-send-email-glommer@redhat.com>
Patchwork-id: 9323
O-Subject: [RHEL5.6 PATCH] KVM: Fix wallclock version writing race
Bugzilla: 592021
RH-Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com>
RH-Acked-by: Zachary Amsden <zamsden@redhat.com>
RH-Acked-by: Juan Quintela <quintela@redhat.com>

From: Avi Kivity <avi@redhat.com>

RH-Bugzilla: 592021
RH-Author: Glauber Costa <glommer@redhat.com>
RH-Upstream-status: kvm/master

Wallclock writing uses an unprotected global variable to hold the version;
this can cause one guest to interfere with another if both write their
wallclock at the same time.

Acked-by: Glauber Costa <glommer@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
---
 arch/x86/kvm/x86.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 arch/x86/kvm/x86.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bd28343..363141c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -574,14 +574,22 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
 
 static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
 {
-	static int version;
+	int version;
+	int r;
 	struct pvclock_wall_clock wc;
 	struct timespec now, sys, boot;
 
 	if (!wall_clock)
 		return;
 
-	version++;
+	r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version));
+	if (r)
+		return;
+
+	if (version & 1)
+		++version;  /* first time write, random junk */
+
+	++version;
 
 	kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
 
-- 
1.7.0.3