* [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
@ 2019-11-28 6:38 linmiaohe
2019-11-28 8:49 ` Auger Eric
2019-12-06 11:53 ` Marc Zyngier
0 siblings, 2 replies; 3+ messages in thread
From: linmiaohe @ 2019-11-28 6:38 UTC (permalink / raw)
To: maz, pbonzini, rkrcmar, james.morse, julien.thierry.kdev,
suzuki.poulose, christoffer.dall, catalin.marinas, eric.auger,
gregkh, will, andre.przywara, tglx
Cc: linmiaohe, linux-arm-kernel, kvmarm, linux-kernel, kvm
From: Miaohe Lin <linmiaohe@huawei.com>
In kvm_vgic_dist_init() called from kvm_vgic_map_resources(), if
dist->vgic_model is invalid, dist->spis will be freed without set
dist->spis = NULL. And in vgicv2 resources clean up path,
__kvm_vgic_destroy() will be called to free allocated resources.
And dist->spis will be freed again in clean up chain because we
forget to set dist->spis = NULL in kvm_vgic_dist_init() failed
path. So double free would happen.
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
virt/kvm/arm/vgic/vgic-init.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 53e3969dfb52..c17c29beeb72 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -171,6 +171,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
break;
default:
kfree(dist->spis);
+ dist->spis = NULL;
return -EINVAL;
}
}
--
2.19.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
2019-11-28 6:38 [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() linmiaohe
@ 2019-11-28 8:49 ` Auger Eric
2019-12-06 11:53 ` Marc Zyngier
1 sibling, 0 replies; 3+ messages in thread
From: Auger Eric @ 2019-11-28 8:49 UTC (permalink / raw)
To: linmiaohe, maz, pbonzini, rkrcmar, james.morse,
julien.thierry.kdev, suzuki.poulose, christoffer.dall,
catalin.marinas, gregkh, will, andre.przywara, tglx
Cc: linux-arm-kernel, kvmarm, linux-kernel, kvm
Hi,
On 11/28/19 7:38 AM, linmiaohe wrote:
> From: Miaohe Lin <linmiaohe@huawei.com>
>
> In kvm_vgic_dist_init() called from kvm_vgic_map_resources(), if
> dist->vgic_model is invalid, dist->spis will be freed without set
> dist->spis = NULL. And in vgicv2 resources clean up path,
> __kvm_vgic_destroy() will be called to free allocated resources.
> And dist->spis will be freed again in clean up chain because we
> forget to set dist->spis = NULL in kvm_vgic_dist_init() failed
> path. So double free would happen.
>
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Thanks
Eric
> ---
> virt/kvm/arm/vgic/vgic-init.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
> index 53e3969dfb52..c17c29beeb72 100644
> --- a/virt/kvm/arm/vgic/vgic-init.c
> +++ b/virt/kvm/arm/vgic/vgic-init.c
> @@ -171,6 +171,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
> break;
> default:
> kfree(dist->spis);
> + dist->spis = NULL;
> return -EINVAL;
> }
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
2019-11-28 6:38 [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() linmiaohe
2019-11-28 8:49 ` Auger Eric
@ 2019-12-06 11:53 ` Marc Zyngier
1 sibling, 0 replies; 3+ messages in thread
From: Marc Zyngier @ 2019-12-06 11:53 UTC (permalink / raw)
To: linmiaohe
Cc: pbonzini, rkrcmar, james.morse, julien.thierry.kdev,
suzuki.poulose, christoffer.dall, catalin.marinas, eric.auger,
gregkh, will, andre.przywara, tglx, linux-arm-kernel, kvmarm,
linux-kernel, kvm
On 2019-11-28 06:38, linmiaohe wrote:
> From: Miaohe Lin <linmiaohe@huawei.com>
>
> In kvm_vgic_dist_init() called from kvm_vgic_map_resources(), if
> dist->vgic_model is invalid, dist->spis will be freed without set
> dist->spis = NULL. And in vgicv2 resources clean up path,
> __kvm_vgic_destroy() will be called to free allocated resources.
> And dist->spis will be freed again in clean up chain because we
> forget to set dist->spis = NULL in kvm_vgic_dist_init() failed
> path. So double free would happen.
>
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> ---
> virt/kvm/arm/vgic/vgic-init.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/virt/kvm/arm/vgic/vgic-init.c
> b/virt/kvm/arm/vgic/vgic-init.c
> index 53e3969dfb52..c17c29beeb72 100644
> --- a/virt/kvm/arm/vgic/vgic-init.c
> +++ b/virt/kvm/arm/vgic/vgic-init.c
> @@ -171,6 +171,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm,
> unsigned int nr_spis)
> break;
> default:
> kfree(dist->spis);
> + dist->spis = NULL;
> return -EINVAL;
> }
> }
Applied, thanks.
M.
--
Jazz is not dead. It just smells funny...
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-06 11:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-28 6:38 [PATCH] KVM: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() linmiaohe
2019-11-28 8:49 ` Auger Eric
2019-12-06 11:53 ` Marc Zyngier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).