Patch "kvm: fix usage of uninit spinlock in avic_vm_destroy()" has been added to the 4.9-stable tree

Patch "kvm: fix usage of uninit spinlock in avic_vm_destroy()" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    kvm: fix usage of uninit spinlock in avic_vm_destroy()

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-fix-usage-of-uninit-spinlock-in-avic_vm_destroy.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Thu Dec 21 09:02:40 CET 2017
From: Dmitry Vyukov <dvyukov@google.com>
Date: Tue, 24 Jan 2017 14:06:48 +0100
Subject: kvm: fix usage of uninit spinlock in avic_vm_destroy()

From: Dmitry Vyukov <dvyukov@google.com>


[ Upstream commit 3863dff0c3dd72984395c93b12383b393c5c3989 ]

If avic is not enabled, avic_vm_init() does nothing and returns early.
However, avic_vm_destroy() still tries to destroy what hasn't been created.
The only bad consequence of this now is that avic_vm_destroy() uses
svm_vm_data_hash_lock that hasn't been initialized (and is not meant
to be used at all if avic is not enabled).

Return early from avic_vm_destroy() if avic is not enabled.
It has nothing to destroy.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: kvm@vger.kernel.org
Cc: syzkaller@googlegroups.com
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1382,6 +1382,9 @@ static void avic_vm_destroy(struct kvm *
 	unsigned long flags;
 	struct kvm_arch *vm_data = &kvm->arch;
 
+	if (!avic)
+		return;
+
 	avic_free_vm_id(vm_data->avic_vm_id);
 
 	if (vm_data->avic_logical_id_table_page)


Patches currently in stable-queue which might be from dvyukov@google.com are

queue-4.9/kvm-fix-usage-of-uninit-spinlock-in-avic_vm_destroy.patch
queue-4.9/inet-frag-release-spinlock-before-calling-icmp_send.patch
queue-4.9/crypto-deadlock-between-crypto_alg_sem-rtnl_mutex-genl_mutex.patch