From: Alexey Kardashevskiy <aik@ozlabs.ru> To: kvm@vger.kernel.org Cc: Alexey Kardashevskiy <aik@ozlabs.ru>, Paolo Bonzini <pbonzini@redhat.com>, kvm-ppc@vger.kernel.org Subject: [PATCH kernel] KVM: Don't null dereference ops->destroy Date: Tue, 24 May 2022 15:52:08 +1000 [thread overview] Message-ID: <20220524055208.1269279-1-aik@ozlabs.ru> (raw) There are 2 places calling kvm_device_ops::destroy(): 1) when creating a KVM device failed; 2) when a VM is destroyed: kvm_destroy_devices() destroys all devices from &kvm->devices. All 3 Book3s's interrupt controller KVM devices (XICS, XIVE, XIVE-native) do not define kvm_device_ops::destroy() and only define release() which is normally fine as device fds are closed before KVM gets to 2) but by then the &kvm->devices list is empty. However Syzkaller manages to trigger 1). This adds checks in 1) and 2). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> --- I could define empty handlers for XICS/XIVE guys but kvm_ioctl_create_device() already checks for ops->init() so I guess kvm_device_ops are expected to not have certain handlers. --- virt/kvm/kvm_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index f30bb8c16f26..17f698ccddd1 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1205,7 +1205,8 @@ static void kvm_destroy_devices(struct kvm *kvm) */ list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) { list_del(&dev->vm_node); - dev->ops->destroy(dev); + if (dev->ops->destroy) + dev->ops->destroy(dev); } } @@ -4300,7 +4301,8 @@ static int kvm_ioctl_create_device(struct kvm *kvm, mutex_lock(&kvm->lock); list_del(&dev->vm_node); mutex_unlock(&kvm->lock); - ops->destroy(dev); + if (ops->destroy) + ops->destroy(dev); return ret; } -- 2.30.2
WARNING: multiple messages have this Message-ID (diff)
From: Alexey Kardashevskiy <aik@ozlabs.ru> To: kvm@vger.kernel.org Cc: Alexey Kardashevskiy <aik@ozlabs.ru>, Paolo Bonzini <pbonzini@redhat.com>, kvm-ppc@vger.kernel.org Subject: [PATCH kernel] KVM: Don't null dereference ops->destroy Date: Tue, 24 May 2022 05:52:08 +0000 [thread overview] Message-ID: <20220524055208.1269279-1-aik@ozlabs.ru> (raw) There are 2 places calling kvm_device_ops::destroy(): 1) when creating a KVM device failed; 2) when a VM is destroyed: kvm_destroy_devices() destroys all devices from &kvm->devices. All 3 Book3s's interrupt controller KVM devices (XICS, XIVE, XIVE-native) do not define kvm_device_ops::destroy() and only define release() which is normally fine as device fds are closed before KVM gets to 2) but by then the &kvm->devices list is empty. However Syzkaller manages to trigger 1). This adds checks in 1) and 2). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> --- I could define empty handlers for XICS/XIVE guys but kvm_ioctl_create_device() already checks for ops->init() so I guess kvm_device_ops are expected to not have certain handlers. --- virt/kvm/kvm_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index f30bb8c16f26..17f698ccddd1 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1205,7 +1205,8 @@ static void kvm_destroy_devices(struct kvm *kvm) */ list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) { list_del(&dev->vm_node); - dev->ops->destroy(dev); + if (dev->ops->destroy) + dev->ops->destroy(dev); } } @@ -4300,7 +4301,8 @@ static int kvm_ioctl_create_device(struct kvm *kvm, mutex_lock(&kvm->lock); list_del(&dev->vm_node); mutex_unlock(&kvm->lock); - ops->destroy(dev); + if (ops->destroy) + ops->destroy(dev); return ret; } -- 2.30.2
next reply other threads:[~2022-05-24 5:52 UTC|newest] Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-24 5:52 Alexey Kardashevskiy [this message] 2022-05-24 5:52 ` [PATCH kernel] KVM: Don't null dereference ops->destroy Alexey Kardashevskiy 2022-05-24 20:01 ` Sean Christopherson 2022-05-25 1:52 ` Alexey Kardashevskiy 2022-05-25 1:52 ` Alexey Kardashevskiy 2022-05-25 2:58 ` Alexey Kardashevskiy 2022-05-25 2:58 ` Alexey Kardashevskiy 2022-05-25 7:47 ` Paolo Bonzini 2022-05-25 7:47 ` Paolo Bonzini 2022-05-31 4:32 ` Alexey Kardashevskiy 2022-05-31 4:32 ` Alexey Kardashevskiy 2022-05-31 17:13 ` Paolo Bonzini 2022-05-31 17:13 ` Paolo Bonzini
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220524055208.1269279-1-aik@ozlabs.ru \ --to=aik@ozlabs.ru \ --cc=kvm-ppc@vger.kernel.org \ --cc=kvm@vger.kernel.org \ --cc=pbonzini@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.