From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:47994 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S935338AbdCWRbN (ORCPT ); Thu, 23 Mar 2017 13:31:13 -0400 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v2NHIwEt142344 for ; Thu, 23 Mar 2017 13:31:11 -0400 Received: from e06smtp14.uk.ibm.com (e06smtp14.uk.ibm.com [195.75.94.110]) by mx0a-001b2d01.pphosted.com with ESMTP id 29bt5djx3a-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 23 Mar 2017 13:31:11 -0400 Received: from localhost by e06smtp14.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 23 Mar 2017 17:31:09 -0000 Date: Thu, 23 Mar 2017 18:31:02 +0100 From: Cornelia Huck To: David Hildenbrand Cc: kvm@vger.kernel.org, Paolo Bonzini , rkrcmar@redhat.com, Dmitry Vyukov , Marcelo Tosatti , stable@vger.kernel.org, LKML Subject: Re: [PATCH v2] KVM: kvm_io_bus_unregister_dev() should never fail In-Reply-To: <20170323172419.21435-1-david@redhat.com> References: <20170323172419.21435-1-david@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20170323183102.5f0f66e4.cornelia.huck@de.ibm.com> Sender: stable-owner@vger.kernel.org List-ID: On Thu, 23 Mar 2017 18:24:19 +0100 David Hildenbrand wrote: > No caller currently checks the return value of > kvm_io_bus_unregister_dev(). This is evil, as all callers silently go on > freeing their device. A stale reference will remain in the io_bus, > getting at least used again, when the iobus gets teared down on > kvm_destroy_vm() - leading to use after free errors. > > There is nothing the callers could do, except retrying over and over > again. > > So let's simply remove the bus altogether, print an error and make > sure no one can access this broken bus again (returning -ENOMEM on any > attempt to access it). > > Fixes: e93f8a0f821e ("KVM: convert io_bus to SRCU") > Cc: stable@vger.kernel.org # 3.4+ > Reported-by: Dmitry Vyukov > Signed-off-by: David Hildenbrand > --- > > Based on kvm/queue, where we just got 2a108a4e7c1 ("KVM: x86: clear bus > pointer when destroyed"), which added a check we need here. > > v1 -> v2: > - added a check in kvm_destroy_vm() > - added a check in virt/kvm/eventfd.c > > Using 'git grep -C 4 "kvm->buses"' should help to find all users. The other > user in virt/kvm/eventfd.c should be fine. > > --- > include/linux/kvm_host.h | 4 ++-- > virt/kvm/eventfd.c | 3 ++- > virt/kvm/kvm_main.c | 42 +++++++++++++++++++++++++----------------- > 3 files changed, 29 insertions(+), 20 deletions(-) Reviewed-by: Cornelia Huck