aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2018-05-28 13:31:13 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2018-07-18 11:31:27 +0200
commit9432a3175770e06cb83eada2d91fac90c977cb99 (patch)
tree13f5e44fdcc83b3b5fdc7607290064130af84853
parentKVM/Eventfd: Avoid crash when assign and deassign specific eventfd in parallel. (diff)
downloadlinux-dev-9432a3175770e06cb83eada2d91fac90c977cb99.tar.xz
linux-dev-9432a3175770e06cb83eada2d91fac90c977cb99.zip
KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
A comment warning against this bug is there, but the code is not doing what the comment says. Therefore it is possible that an EPOLLHUP races against irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown, and if that runs soon enough, you get a use-after-free. Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com>
-rw-r--r--virt/kvm/eventfd.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index decefe944b0f..fe6eb0fe07f6 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
if (events & EPOLLIN)
schedule_work(&irqfd->inject);
- /*
- * do not drop the file until the irqfd is fully initialized, otherwise
- * we might race against the EPOLLHUP
- */
- fdput(f);
#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
if (kvm_arch_has_irq_bypass()) {
irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
#endif
srcu_read_unlock(&kvm->irq_srcu, idx);
+
+ /*
+ * do not drop the file until the irqfd is fully initialized, otherwise
+ * we might race against the EPOLLHUP
+ */
+ fdput(f);
return 0;
fail: