From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+c51e6736a1bf614b3272@syzkaller.appspotmail.com,
Jason Wang <jasowang@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.17 07/42] vhost: reset metadata cache when initializing new IOTLB
Date: Tue, 21 Aug 2018 08:20:39 +0200 [thread overview]
Message-ID: <20180821055017.923253670@linuxfoundation.org> (raw)
In-Reply-To: <20180821055017.596264829@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit b13f9c6364373a1b9f71e9846dc4fb199296f926 ]
We need to reset metadata cache during new IOTLB initialization,
otherwise the stale pointers to previous IOTLB may be still accessed
which will lead a use after free.
Reported-by: syzbot+c51e6736a1bf614b3272@syzkaller.appspotmail.com
Fixes: f88949138058 ("vhost: introduce O(1) vq metadata cache")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/vhost.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1556,9 +1556,12 @@ int vhost_init_device_iotlb(struct vhost
d->iotlb = niotlb;
for (i = 0; i < d->nvqs; ++i) {
- mutex_lock(&d->vqs[i]->mutex);
- d->vqs[i]->iotlb = niotlb;
- mutex_unlock(&d->vqs[i]->mutex);
+ struct vhost_virtqueue *vq = d->vqs[i];
+
+ mutex_lock(&vq->mutex);
+ vq->iotlb = niotlb;
+ __vhost_vq_meta_reset(vq);
+ mutex_unlock(&vq->mutex);
}
vhost_umem_clean(oiotlb);
next prev parent reply other threads:[~2018-08-21 6:25 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-21 6:20 [PATCH 4.17 00/42] 4.17.18-stable review Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 01/42] dccp: fix undefined behavior with cwnd shift in ccid2_cwnd_restart() Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 02/42] l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 03/42] llc: use refcount_inc_not_zero() for llc_sap_find() Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 04/42] net_sched: fix NULL pointer dereference when delete tcindex filter Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 05/42] vsock: split dwork to avoid reinitializations Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 06/42] net_sched: Fix missing res info when create new tc_index filter Greg Kroah-Hartman
2018-08-21 6:20 ` Greg Kroah-Hartman [this message]
2018-08-21 6:20 ` [PATCH 4.17 08/42] mlxsw: core_acl_flex_actions: Return error for conflicting actions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 09/42] net: aquantia: Fix IFF_ALLMULTI flag functionality Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 10/42] ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 11/42] mlxsw: core_acl_flex_actions: Remove redundant resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 12/42] mlxsw: core_acl_flex_actions: Remove redundant counter destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 13/42] mlxsw: core_acl_flex_actions: Remove redundant mirror resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 14/42] net/mlx5e: Properly check if hairpin is possible between two functions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 15/42] r8169: dont use MSI-X on RTL8168g Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 16/42] rxrpc: Fix the keepalive generator [ver #2] Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 17/42] ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 18/42] ALSA: hda - Turn CX8200 into D3 as well upon reboot Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 19/42] ALSA: vx222: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 20/42] ALSA: virmidi: Fix too long output trigger loop Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 21/42] ALSA: cs5535audio: Fix invalid endian conversion Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 22/42] ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 23/42] ALSA: memalloc: Dont exceed over the requested size Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 24/42] ALSA: vxpocket: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 25/42] ALSA: seq: Fix poll() error return Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 26/42] USB: serial: sierra: fix potential deadlock at close Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 27/42] USB: serial: pl2303: add a new device id for ATEN Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 28/42] USB: option: add support for DW5821e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 29/42] ACPI / PM: save NVS memory for ASUS 1025C laptop Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 30/42] tty: serial: 8250: Revert NXP SC16C2552 workaround Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 31/42] serial: 8250_exar: Read INT0 from slave device, too Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 32/42] serial: 8250_dw: always set baud rate in dw8250_set_termios Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 33/42] serial: 8250_dw: Add ACPI support for uart on Broadcom SoC Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 34/42] misc: sram: fix resource leaks in probe error path Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 35/42] Bluetooth: avoid killing an already killed socket Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 36/42] isdn: Disable IIOCDBGVAR Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 37/42] net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 38/42] r8169: dont use MSI-X on RTL8106e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 39/42] ip_vti: fix a null pointer deferrence when create vti fallback tunnel Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 40/42] cls_matchall: fix tcf_unbind_filter missing Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 41/42] net: ethernet: mvneta: Fix napi structure mixup on armada 3700 Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 42/42] net: mvneta: fix mvneta_config_rss " Greg Kroah-Hartman
2018-08-21 14:58 ` [PATCH 4.17 00/42] 4.17.18-stable review Guenter Roeck
2018-08-21 18:04 ` Naresh Kamboju
2018-08-21 19:44 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180821055017.923253670@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=jasowang@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+c51e6736a1bf614b3272@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).