lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <0ecc0739-aa3c-bbf8-b52f-c710cae0675f@redhat.com>
Date:   Fri, 28 Oct 2022 12:47:17 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Eiichi Tsukata <eiichi.tsukata@...anix.com>, seanjc@...gle.com,
        tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
        dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        ankur.a.arora@...cle.com, dwmw@...zon.co.uk,
        joao.m.martins@...cle.com
Cc:     syzbot+6f0c896c5a9449a10ded@...kaller.appspotmail.com
Subject: Re: [PATCH] KVM: x86/xen: Fix eventfd error handling in
 kvm_xen_eventfd_assign()

On 10/28/22 11:26, Eiichi Tsukata wrote:
> Should not call eventfd_ctx_put() in case of error.
> 
> Fixes: 2fd6df2f2b47 ("KVM: x86/xen: intercept EVTCHNOP_send from guests")
> Reported-by: syzbot+6f0c896c5a9449a10ded@...kaller.appspotmail.com
> Signed-off-by: Eiichi Tsukata <eiichi.tsukata@...anix.com>
> ---
>   arch/x86/kvm/xen.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
> index 93c628d3e3a9..a357994982c6 100644
> --- a/arch/x86/kvm/xen.c
> +++ b/arch/x86/kvm/xen.c
> @@ -1716,7 +1716,7 @@ static int kvm_xen_eventfd_assign(struct kvm *kvm,
>   	if (ret == -ENOSPC)
>   		ret = -EEXIST;
>   out:
> -	if (eventfd)
> +	if (eventfd && !IS_ERR(eventfd))
>   		eventfd_ctx_put(eventfd);
>   	kfree(evtchnfd);
>   	return ret;

Slightly more verbose, but cleaner:

diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index 6714bbdbedf3..2dae413bd62a 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -1666,18 +1666,18 @@ static int kvm_xen_eventfd_assign(struct kvm *kvm,
  	case EVTCHNSTAT_ipi:
  		/* IPI  must map back to the same port# */
  		if (data->u.evtchn.deliver.port.port != data->u.evtchn.send_port)
-			goto out; /* -EINVAL */
+			goto out_noeventfd; /* -EINVAL */
  		break;
  
  	case EVTCHNSTAT_interdomain:
  		if (data->u.evtchn.deliver.port.port) {
  			if (data->u.evtchn.deliver.port.port >= max_evtchn_port(kvm))
-				goto out; /* -EINVAL */
+				goto out_noeventfd; /* -EINVAL */
  		} else {
  			eventfd = eventfd_ctx_fdget(data->u.evtchn.deliver.eventfd.fd);
  			if (IS_ERR(eventfd)) {
  				ret = PTR_ERR(eventfd);
-				goto out;
+				goto out_noeventfd;
  			}
  		}
  		break;
@@ -1717,6 +1717,7 @@ static int kvm_xen_eventfd_assign(struct kvm *kvm,
  out:
	if (eventfd)
  		eventfd_ctx_put(eventfd);
+out_noeventfd:
  	kfree(evtchnfd);
  	return ret;
  }

Only the last goto has to be changed in order to fix the bug, the
others are only needed to respect the LIFO order of the unwinding
labels.

Paolo

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ