| From 9432a3175770e06cb83eada2d91fac90c977cb99 Mon Sep 17 00:00:00 2001 |
| From: Paolo Bonzini <pbonzini@redhat.com> |
| Date: Mon, 28 May 2018 13:31:13 +0200 |
| Subject: KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer |
| |
| From: Paolo Bonzini <pbonzini@redhat.com> |
| |
| commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream. |
| |
| A comment warning against this bug is there, but the code is not doing what |
| the comment says. Therefore it is possible that an EPOLLHUP races against |
| irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown, |
| and if that runs soon enough, you get a use-after-free. |
| |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Reviewed-by: David Hildenbrand <david@redhat.com> |
| Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| virt/kvm/eventfd.c | 11 ++++++----- |
| 1 file changed, 6 insertions(+), 5 deletions(-) |
| |
| --- a/virt/kvm/eventfd.c |
| +++ b/virt/kvm/eventfd.c |
| @@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct |
| if (events & POLLIN) |
| schedule_work(&irqfd->inject); |
| |
| - /* |
| - * do not drop the file until the irqfd is fully initialized, otherwise |
| - * we might race against the POLLHUP |
| - */ |
| - fdput(f); |
| #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS |
| if (kvm_arch_has_irq_bypass()) { |
| irqfd->consumer.token = (void *)irqfd->eventfd; |
| @@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct |
| #endif |
| |
| srcu_read_unlock(&kvm->irq_srcu, idx); |
| + |
| + /* |
| + * do not drop the file until the irqfd is fully initialized, otherwise |
| + * we might race against the POLLHUP |
| + */ |
| + fdput(f); |
| return 0; |
| |
| fail: |
