linux-kernel - Re: [PATCH V2] KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in parallel.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6b0960ed-8bc3-51a4-6053-882630e3bb4b@redhat.com>
Date:   Sun, 15 Jul 2018 18:10:40 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Lan Tianyu <tianyu.lan@...el.com>
Cc:     rkrcmar@...hat.com, kvm@...r.kernel.org, dvyukov@...gle.com,
        linux-kernel@...r.kernel.org, david@...hat.com
Subject: Re: [PATCH V2] KVM/Eventfd: Avoid crash when assign and deassign
 specific eventfd in parallel.

On 22/12/2017 03:10, Lan Tianyu wrote:
> Syzroot reports crash in kvm_irqfd_assign() is caused by use-after-free.
> Because kvm_irqfd_assign() and kvm_irqfd_deassign() can't run in parallel
> for one specific eventfd. When assign path hasn't been finished after irqfd
> has been added to kvm->irqfds.items list, another thead may deassign the
> eventfd and free struct kvm_kernel_irqfd(). This causes assign path still
> uses struct kvm_kernel_irqfd freed by deassign path. To avoid such issue,
> make irqfd's reference under kvm->irq_srcu protection after irqfd added to
> kvm->irqfds.iterms list and call synchronize_srcu() in irq_shutdown() to
> make sure that irqfd has been fully initialized in the assign path.
> 
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> Cc: Radim Krčmář <rkrcmar@...hat.com>
> Cc: Dmitry Vyukov <dvyukov@...gle.com>
> Signed-off-by: Tianyu Lan <tianyu.lan@...el.com>
> ---
>  virt/kvm/eventfd.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
> index a334399fafec..0abc2e9ddafb 100644
> --- a/virt/kvm/eventfd.c
> +++ b/virt/kvm/eventfd.c
> @@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work)
>  {
>  	struct kvm_kernel_irqfd *irqfd =
>  		container_of(work, struct kvm_kernel_irqfd, shutdown);
> +	struct kvm *kvm = irqfd->kvm;
>  	u64 cnt;
>  
> +	/* Make sure irqfd has been initalized in assign path. */
> +	synchronize_srcu(&kvm->irq_srcu);
> +
>  	/*
>  	 * Synchronize with the wait-queue and unhook ourselves to prevent
>  	 * further events.
> @@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
>  
>  	idx = srcu_read_lock(&kvm->irq_srcu);
>  	irqfd_update(kvm, irqfd);
> -	srcu_read_unlock(&kvm->irq_srcu, idx);
>  
>  	list_add_tail(&irqfd->list, &kvm->irqfds.items);
>  
> @@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
>  	}
>  #endif
>  
> +	srcu_read_unlock(&kvm->irq_srcu, idx);
>  	return 0;
>  
>  fail:
> 

Queued, at last.  Thanks,

Paolo