Viresh Kumar e997b357b1 xen: privcmd: Fix possible access to a freed kirqfd instance ... [ Upstream commit 611ff1b1ae ] Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks. This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops. Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/9e884af1f1f842eacbb7afc5672c8feb4dea7f3f.1718703669.git.viresh.kumar@linaro.org Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-09-12 11:11:35 +02:00
..
events	xen/events: increment refcnt only if event channel is refcounted	2024-03-26 18:20:09 -04:00
xen-pciback
xenbus	drivers/xen: Improve the late XenStore init protocol	2024-06-12 11:12:51 +02:00
xenfs
acpi.c
arm-device.c
balloon.c	x86/xen: attempt to inflate the memory balloon on PVH	2024-04-13 13:07:39 +02:00
biomerge.c
cpu_hotplug.c
dbgp.c
efi.c
evtchn.c	xen/evtchn: avoid WARN() when unbinding an event channel	2024-03-26 18:20:09 -04:00
features.c
gntalloc.c
gntdev-common.h
gntdev-dmabuf.c
gntdev-dmabuf.h
gntdev.c
grant-dma-iommu.c
grant-dma-ops.c	Revert "change alloc_pages name in dma_map_ops to avoid name conflicts"	2024-09-04 13:28:24 +02:00
grant-table.c
Kconfig
Makefile
manage.c
mcelog.c
mem-reservation.c
pci.c
pcpu.c
platform-pci.c
privcmd-buf.c
privcmd.c	xen: privcmd: Fix possible access to a freed kirqfd instance	2024-09-12 11:11:35 +02:00
privcmd.h
pvcalls-back.c
pvcalls-front.c
pvcalls-front.h
swiotlb-xen.c	Revert "change alloc_pages name in dma_map_ops to avoid name conflicts"	2024-09-04 13:28:24 +02:00
sys-hypervisor.c
time.c
unpopulated-alloc.c
xen-acpi-pad.c
xen-acpi-processor.c
xen-balloon.c
xen-front-pgdir-shbuf.c
xen-scsiback.c
xlate_mmu.c