All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH 3.18,4.4] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)g
Date: Wed, 20 Feb 2019 23:10:18 -0500	[thread overview]
Message-ID: <20190221041018.GC10616@sasha-vm> (raw)
In-Reply-To: <20190218165328.100978-1-jannh@google.com>

On Mon, Feb 18, 2019 at 05:53:28PM +0100, Jann Horn wrote:
>commit cfa39381173d5f969daf43582c95ad679189cbc9 upstream.
>
>kvm_ioctl_create_device() does the following:
>
>1. creates a device that holds a reference to the VM object (with a borrowed
>   reference, the VM's refcount has not been bumped yet)
>2. initializes the device
>3. transfers the reference to the device to the caller's file descriptor table
>4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
>   reference
>
>The ownership transfer in step 3 must not happen before the reference to the VM
>becomes a proper, non-borrowed reference, which only happens in step 4.
>After step 3, an attacker can close the file descriptor and drop the borrowed
>reference, which can cause the refcount of the kvm object to drop to zero.
>
>This means that we need to grab a reference for the device before
>anon_inode_getfd(), otherwise the VM can disappear from under us.
>
>Fixes: 852b6d57dc7f ("kvm: add device control API")
>Cc: stable@kernel.org
>Signed-off-by: Jann Horn <jannh@google.com>

Hi Jann,

You've dropped Paolo's S-O-B line, was it on purpose?

--
Thanks,
Sasha

  reply	other threads:[~2019-02-21  4:10 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-18 16:53 [PATCH 3.18,4.4] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Jann Horn
2019-02-21  4:10 ` Sasha Levin [this message]
2019-02-21 13:03   ` [PATCH 3.18,4.4] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)g Jann Horn
2019-02-21 17:46     ` Paolo Bonzini
2019-02-21 11:50 ` [PATCH 3.18,4.4] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190221041018.GC10616@sasha-vm \
    --to=sashal@kernel.org \
    --cc=jannh@google.com \
    --cc=pbonzini@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.