Sean Christopherson a0f4fd4868 KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref ... [ Upstream commit 5c697c367a ] Initialize debugfs_entry to its semi-magical -ENOENT value when the VM is created. KVM's teardown when VM creation fails is kludgy and calls kvm_uevent_notify_change() and kvm_destroy_vm_debugfs() even if KVM never attempted kvm_create_vm_debugfs(). Because debugfs_entry is zero initialized, the IS_ERR() checks pass and KVM derefs a NULL pointer. BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1068b1067 P4D 1068b1067 PUD 1068b0067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 871 Comm: repro Not tainted 5.18.0-rc1+ #825 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__dentry_path+0x7b/0x130 Call Trace: <TASK> dentry_path_raw+0x42/0x70 kvm_uevent_notify_change.part.0+0x10c/0x200 [kvm] kvm_put_kvm+0x63/0x2b0 [kvm] kvm_dev_ioctl+0x43a/0x920 [kvm] __x64_sys_ioctl+0x83/0xb0 do_syscall_64+0x31/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> Modules linked in: kvm_intel kvm irqbypass Fixes: a44a4cc1c9 ("KVM: Don't create VM debugfs files outside of the VM directory") Cc: stable@vger.kernel.org Cc: Marc Zyngier <maz@kernel.org> Cc: Oliver Upton <oupton@google.com> Reported-by: syzbot+df6fbbd2ee39f21289ef@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Oliver Upton <oupton@google.com> Message-Id: <20220415004622.2207751-1-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-07-12 16:35:05 +02:00
..
async_pf.c	mm/gup: remove task_struct pointer for all gup code	2020-08-12 10:58:04 -07:00
async_pf.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504	2019-06-19 17:09:56 +02:00
binary_stats.c	KVM: stats: remove dead stores	2021-08-13 03:35:15 -04:00
coalesced_mmio.c	KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio	2021-07-14 12:17:56 -04:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dirty_ring.c	KVM: Drop unused kvm_dirty_gfn_invalid()	2021-09-06 08:23:46 -04:00
eventfd.c	KVM: eventfd: Fix false positive RCU usage warning	2022-02-16 12:56:16 +01:00
irqchip.c	KVM/arm updates for 5.3	2019-07-11 15:14:16 +02:00
Kconfig	kvm: add PM-notifier	2021-06-17 13:09:32 -04:00
kvm_main.c	KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref	2022-07-12 16:35:05 +02:00
mmu_lock.h	KVM: x86/mmu: Use an rwlock for the x86 MMU	2021-02-04 05:27:43 -05:00
vfio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00