* request for 4.14-stable: 9432a3175770 ("KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer")
@ 2018-08-20 19:17 Sudip Mukherjee
2018-08-22 9:08 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Sudip Mukherjee @ 2018-08-20 19:17 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable, syzbot, Paolo Bonzini, David Hildenbrand
[-- Attachment #1: Type: text/plain, Size: 89 bytes --]
Hi Greg,
This was missing in 4.14-stable. Please apply to your queue.
--
Regards
Sudip
[-- Attachment #2: 0001-KVM-irqfd-fix-race-between-EPOLLHUP-and-irq_bypass_r.patch --]
[-- Type: text/x-diff, Size: 1752 bytes --]
>From 4f195c2bb7b04d3f9a31684847edd651a32be89a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 28 May 2018 13:31:13 +0200
Subject: [PATCH] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream
A comment warning against this bug is there, but the code is not doing what
the comment says. Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
---
virt/kvm/eventfd.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 58a9b31b0dd5..088734a700e9 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
if (events & POLLIN)
schedule_work(&irqfd->inject);
- /*
- * do not drop the file until the irqfd is fully initialized, otherwise
- * we might race against the POLLHUP
- */
- fdput(f);
#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
if (kvm_arch_has_irq_bypass()) {
irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
#endif
srcu_read_unlock(&kvm->irq_srcu, idx);
+
+ /*
+ * do not drop the file until the irqfd is fully initialized, otherwise
+ * we might race against the POLLHUP
+ */
+ fdput(f);
return 0;
fail:
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: request for 4.14-stable: 9432a3175770 ("KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer")
2018-08-20 19:17 request for 4.14-stable: 9432a3175770 ("KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer") Sudip Mukherjee
@ 2018-08-22 9:08 ` Greg Kroah-Hartman
0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-22 9:08 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: stable, syzbot, Paolo Bonzini, David Hildenbrand
On Mon, Aug 20, 2018 at 08:17:42PM +0100, Sudip Mukherjee wrote:
> Hi Greg,
>
> This was missing in 4.14-stable. Please apply to your queue.
Now queued up, also to older kernels.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-08-22 12:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-20 19:17 request for 4.14-stable: 9432a3175770 ("KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer") Sudip Mukherjee
2018-08-22 9:08 ` Greg Kroah-Hartman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.