linux-kernel - Re: [PATCH] KVM: Destroy target device if coalesced MMIO unregistration fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed,  1 Feb 2023 22:37:35 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        "柳菁峰" <liujingfeng@...nxin.com>,
        Wei Wang <wei.w.wang@...el.com>, Michal Luczaj <mhal@...x.co>
Subject: Re: [PATCH] KVM: Destroy target device if coalesced MMIO
 unregistration fails

On Mon, 19 Dec 2022 17:19:24 +0000, Sean Christopherson wrote:
> Destroy and free the target coalesced MMIO device if unregistering said
> device fails.  As clearly noted in the code, kvm_io_bus_unregister_dev()
> does not destroy the target device.
> 
>   BUG: memory leak
>   unreferenced object 0xffff888112a54880 (size 64):
>     comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s)
>     hex dump (first 32 bytes):
>       38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff  8.g.....8.g.....
>       e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff  .........0g.....
>     backtrace:
>       [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline]
>       [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline]
>       [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150
>       [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323
>       [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline]
>       [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline]
>       [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696
>       [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713
>       [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>       [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>       [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
>       [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290
>       [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
> 
> [...]

Applied to kvm-x86 generic, the plan is that Wei will send the bigger
cleanup on top.  Thanks!

[1/1] KVM: Destroy target device if coalesced MMIO unregistration fails
      https://github.com/kvm-x86/linux/commit/b1cb1fac22ab

--
https://github.com/kvm-x86/linux/tree/next
https://github.com/kvm-x86/linux/tree/fixes