diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2018-05-28 13:31:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-08-24 13:09:21 +0200 |
| commit | 270d5d77191769eaa57f94eff3ef8119121a091a (patch) | |
| tree | 273263dc89891d0375fbbf755a0806cc6434d045 /virt | |
| parent | 7a12f4ed07a5f7b49c7d4f86ea67f65ec953cc40 (diff) | |
| download | linux-exynos-270d5d77191769eaa57f94eff3ef8119121a091a.tar.gz linux-exynos-270d5d77191769eaa57f94eff3ef8119121a091a.tar.bz2 linux-exynos-270d5d77191769eaa57f94eff3ef8119121a091a.zip | |
KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.
A comment warning against this bug is there, but the code is not doing what
the comment says. Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'virt')
| -rw-r--r-- | virt/kvm/eventfd.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c index 58a9b31b0dd5..088734a700e9 100644 --- a/virt/kvm/eventfd.c +++ b/virt/kvm/eventfd.c @@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) if (events & POLLIN) schedule_work(&irqfd->inject); - /* - * do not drop the file until the irqfd is fully initialized, otherwise - * we might race against the POLLHUP - */ - fdput(f); #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS if (kvm_arch_has_irq_bypass()) { irqfd->consumer.token = (void *)irqfd->eventfd; @@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) #endif srcu_read_unlock(&kvm->irq_srcu, idx); + + /* + * do not drop the file until the irqfd is fully initialized, otherwise + * we might race against the POLLHUP + */ + fdput(f); return 0; fail: |