Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9432a317 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer 



A comment warning against this bug is there, but the code is not doing what
the comment says.  Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer.  The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.

Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
parent b5020a8e

virt/kvm/eventfd.c

+6 −5
Original line number Diff line number Diff line
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) 
	if (events & EPOLLIN)

		schedule_work(&irqfd->inject);



	/*

	 * do not drop the file until the irqfd is fully initialized, otherwise

	 * we might race against the EPOLLHUP

	 */

	fdput(f);

#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS

	if (kvm_arch_has_irq_bypass()) {

		irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) 
#endif



	srcu_read_unlock(&kvm->irq_srcu, idx);



	/*

	 * do not drop the file until the irqfd is fully initialized, otherwise

	 * we might race against the EPOLLHUP

	 */

	fdput(f);

	return 0;



fail: