| Message ID | 20171222021036.13107-1-tianyu.lan@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 22/12/2017 03:10, Lan Tianyu wrote: > Syzroot reports crash in kvm_irqfd_assign() is caused by use-after-free. > Because kvm_irqfd_assign() and kvm_irqfd_deassign() can't run in parallel > for one specific eventfd. When assign path hasn't been finished after irqfd > has been added to kvm->irqfds.items list, another thead may deassign the > eventfd and free struct kvm_kernel_irqfd(). This causes assign path still > uses struct kvm_kernel_irqfd freed by deassign path. To avoid such issue, > make irqfd's reference under kvm->irq_srcu protection after irqfd added to > kvm->irqfds.iterms list and call synchronize_srcu() in irq_shutdown() to > make sure that irqfd has been fully initialized in the assign path. > > Reported-by: Dmitry Vyukov <dvyukov@google.com> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Radim Krčmář <rkrcmar@redhat.com> > Cc: Dmitry Vyukov <dvyukov@google.com> > Signed-off-by: Tianyu Lan <tianyu.lan@intel.com> > --- > virt/kvm/eventfd.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c > index a334399fafec..0abc2e9ddafb 100644 > --- a/virt/kvm/eventfd.c > +++ b/virt/kvm/eventfd.c > @@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work) > { > struct kvm_kernel_irqfd *irqfd = > container_of(work, struct kvm_kernel_irqfd, shutdown); > + struct kvm *kvm = irqfd->kvm; > u64 cnt; > > + /* Make sure irqfd has been initalized in assign path. */ > + synchronize_srcu(&kvm->irq_srcu); > + > /* > * Synchronize with the wait-queue and unhook ourselves to prevent > * further events. > @@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) > > idx = srcu_read_lock(&kvm->irq_srcu); > irqfd_update(kvm, irqfd); > - srcu_read_unlock(&kvm->irq_srcu, idx); > > list_add_tail(&irqfd->list, &kvm->irqfds.items); > > @@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) > } > #endif > > + srcu_read_unlock(&kvm->irq_srcu, idx); > return 0; > > fail: > Queued, at last. Thanks, Paolo
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c index a334399fafec..0abc2e9ddafb 100644 --- a/virt/kvm/eventfd.c +++ b/virt/kvm/eventfd.c @@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work) { struct kvm_kernel_irqfd *irqfd = container_of(work, struct kvm_kernel_irqfd, shutdown); + struct kvm *kvm = irqfd->kvm; u64 cnt; + /* Make sure irqfd has been initalized in assign path. */ + synchronize_srcu(&kvm->irq_srcu); + /* * Synchronize with the wait-queue and unhook ourselves to prevent * further events. @@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) idx = srcu_read_lock(&kvm->irq_srcu); irqfd_update(kvm, irqfd); - srcu_read_unlock(&kvm->irq_srcu, idx); list_add_tail(&irqfd->list, &kvm->irqfds.items); @@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) } #endif + srcu_read_unlock(&kvm->irq_srcu, idx); return 0; fail:
Syzroot reports crash in kvm_irqfd_assign() is caused by use-after-free. Because kvm_irqfd_assign() and kvm_irqfd_deassign() can't run in parallel for one specific eventfd. When assign path hasn't been finished after irqfd has been added to kvm->irqfds.items list, another thead may deassign the eventfd and free struct kvm_kernel_irqfd(). This causes assign path still uses struct kvm_kernel_irqfd freed by deassign path. To avoid such issue, make irqfd's reference under kvm->irq_srcu protection after irqfd added to kvm->irqfds.iterms list and call synchronize_srcu() in irq_shutdown() to make sure that irqfd has been fully initialized in the assign path. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Tianyu Lan <tianyu.lan@intel.com> --- virt/kvm/eventfd.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)