Re: [PATCH] Revert "KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio"

[Sean Christopherson <seanjc@google.com>]

On Wed, Jan 18, 2023, Michal Luczaj wrote:
> Signed-off-by: Michal Luczaj <mhal@rbox.co>
> ---
>  virt/kvm/coalesced_mmio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
> index 0be80c213f7f..f08f5e82460b 100644
> --- a/virt/kvm/coalesced_mmio.c
> +++ b/virt/kvm/coalesced_mmio.c
> @@ -186,6 +186,7 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
>  		    coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
>  			r = kvm_io_bus_unregister_dev(kvm,
>  				zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
> +			kvm_iodevice_destructor(&dev->dev);
>  
>  			/*
>  			 * On failure, unregister destroys all devices on the
> @@ -195,7 +196,6 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
>  			 */
>  			if (r)
>  				break;
> -			kvm_iodevice_destructor(&dev->dev);

Already posted[1], but didn't get queued because there's alternative solution[2]
that yields a far cleaner end result, albeit with a larger patch.  I'll follow
up on Wei's patch to move things along.

[1] https://lore.kernel.org/all/20221219171924.67989-1-seanjc@google.com
[2] https://lore.kernel.org/all/20221229123302.4083-1-wei.w.wang@intel.com