All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
	"Denis Kirjanov" <kda@linux-powerpc.org>,
	"Radim Krčmář" <rkrcmar@redhat.com>,
	"David Hildenbrand" <david@redhat.com>,
	"Dan Carpenter" <dan.carpenter@oracle.com>
Subject: [PATCH 3.16 13/16] KVM: use after free in kvm_ioctl_create_device()
Date: Fri, 22 Mar 2019 05:20:18 +0000	[thread overview]
Message-ID: <lsq.1553232018.334881140@decadent.org.uk> (raw)
In-Reply-To: <lsq.1553232017.771830163@decadent.org.uk>

3.16.64-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit a0f1d21c1ccb1da66629627a74059dd7f5ac9c61 upstream.

We should move the ops->destroy(dev) after the list_del(&dev->vm_node)
so that we don't use "dev" after freeing it.

Fixes: a28ebea2adc4 ("KVM: Protect device ops->create and list_add with kvm->lock")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 virt/kvm/kvm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2342,10 +2342,10 @@ static int kvm_ioctl_create_device(struc
 
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
-		ops->destroy(dev);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
+		ops->destroy(dev);
 		return ret;
 	}
 


  parent reply	other threads:[~2019-03-22  5:24 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-22  5:20 [PATCH 3.16 00/16] 3.16.64-rc1 review Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 08/16] HID: debug: fix error handling in hid_debug_events_read() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 07/16] can: gw: ensure DLC boundaries after CAN frame modification Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 09/16] HID: debug: improve hid_debug_event() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 05/16] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 15/16] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 02/16] mm: cma: fix incorrect type conversion for size during dma allocation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 14/16] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 11/16] KVM: PPC: Move xics_debugfs_init out of create Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 01/16] xfs: don't BUG() on mixed direct and mapped I/O Ben Hutchings
2019-03-22  5:20 ` Ben Hutchings [this message]
2019-03-22  5:20 ` [PATCH 3.16 12/16] KVM: Protect device ops->create and list_add with kvm->lock Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 06/16] net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 10/16] HID: debug: fix the ring buffer implementation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 03/16] swiotlb: clean up reporting Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 04/16] sunrpc: use-after-free in svc_process_common() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 16/16] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Ben Hutchings
2019-03-22 13:44 ` [PATCH 3.16 00/16] 3.16.64-rc1 review Guenter Roeck
2019-03-23  4:43   ` Guenter Roeck
2019-03-24 23:25     ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1553232018.334881140@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=dan.carpenter@oracle.com \
    --cc=david@redhat.com \
    --cc=kda@linux-powerpc.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rkrcmar@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.