[PATCH] kvm: fix usage of uninit spinlock in avic_vm_destroy()

[PATCH] kvm: fix usage of uninit spinlock in avic_vm_destroy()

[Dmitry Vyukov]

If avic is not enabled, avic_vm_init() does nothing and returns early.
However, avic_vm_destroy() still tries to destroy what hasn't been created.
The only bad consequence of this now is that avic_vm_destroy() uses
svm_vm_data_hash_lock that hasn't been initialized (and is not meant
to be used at all if avic is not enabled).

Return early from avic_vm_destroy() if avic is not enabled.
It has nothing to destroy.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: kvm@vger.kernel.org
Cc: syzkaller@googlegroups.com
---
 arch/x86/kvm/svm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 08a4d3ab3455..3aecaa13fd22 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1382,6 +1382,9 @@ static void avic_vm_destroy(struct kvm *kvm)
 	unsigned long flags;
 	struct kvm_arch *vm_data = &kvm->arch;
 
+	if (!avic)
+		return;
+
 	avic_free_vm_id(vm_data->avic_vm_id);
 
 	if (vm_data->avic_logical_id_table_page)
-- 
2.11.0.483.g087da7b7c-goog

Re: [PATCH] kvm: fix usage of uninit spinlock in avic_vm_destroy()

[David Hildenbrand]

Am 24.01.2017 um 14:06 schrieb Dmitry Vyukov:
> If avic is not enabled, avic_vm_init() does nothing and returns early.
> However, avic_vm_destroy() still tries to destroy what hasn't been created.
> The only bad consequence of this now is that avic_vm_destroy() uses
> svm_vm_data_hash_lock that hasn't been initialized (and is not meant
> to be used at all if avic is not enabled).
> 
> Return early from avic_vm_destroy() if avic is not enabled.
> It has nothing to destroy.
> 
> Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: "Radim Krčmář" <rkrcmar@redhat.com>
> Cc: David Hildenbrand <david@redhat.com>
> Cc: kvm@vger.kernel.org
> Cc: syzkaller@googlegroups.com
> ---
>  arch/x86/kvm/svm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index 08a4d3ab3455..3aecaa13fd22 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -1382,6 +1382,9 @@ static void avic_vm_destroy(struct kvm *kvm)
>  	unsigned long flags;
>  	struct kvm_arch *vm_data = &kvm->arch;
>  
> +	if (!avic)
> +		return;
> +
>  	avic_free_vm_id(vm_data->avic_vm_id);
>  
>  	if (vm_data->avic_logical_id_table_page)
> 

Reviewed-by: David Hildenbrand <david@redhat.com>

-- 

David

Re: [PATCH] kvm: fix usage of uninit spinlock in avic_vm_destroy()

[Radim Krčmář]

2017-01-24 14:06+0100, Dmitry Vyukov:
> If avic is not enabled, avic_vm_init() does nothing and returns early.
> However, avic_vm_destroy() still tries to destroy what hasn't been created.
> The only bad consequence of this now is that avic_vm_destroy() uses
> svm_vm_data_hash_lock that hasn't been initialized (and is not meant
> to be used at all if avic is not enabled).
> 
> Return early from avic_vm_destroy() if avic is not enabled.
> It has nothing to destroy.
> 
> Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: "Radim Krčmář" <rkrcmar@redhat.com>
> Cc: David Hildenbrand <david@redhat.com>
> Cc: kvm@vger.kernel.org
> Cc: syzkaller@googlegroups.com
> ---

svm_vm_data_hash_lock is initialized unconditionally now, so I've queued
it for 4.12,

Thanks.

>  arch/x86/kvm/svm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index 08a4d3ab3455..3aecaa13fd22 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -1382,6 +1382,9 @@ static void avic_vm_destroy(struct kvm *kvm)
>  	unsigned long flags;
>  	struct kvm_arch *vm_data = &kvm->arch;
>  
> +	if (!avic)
> +		return;
> +
>  	avic_free_vm_id(vm_data->avic_vm_id);
>  
>  	if (vm_data->avic_logical_id_table_page)
> -- 
> 2.11.0.483.g087da7b7c-goog
>