Paolo Bonzini e8d7f0dad2 KVM: avoid NULL pointer dereference in kvm_dirty_ring_push ... commit 5593473a1e upstream. kvm_vcpu_release() will call kvm_dirty_ring_free(), freeing ring->dirty_gfns and setting it to NULL. Afterwards, it calls kvm_arch_vcpu_destroy(). However, if closing the file descriptor races with KVM_RUN in such away that vcpu->arch.st.preempted == 0, the following call stack leads to a NULL pointer dereference in kvm_dirty_run_push(): mark_page_dirty_in_slot+0x192/0x270 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3171 kvm_steal_time_set_preempted arch/x86/kvm/x86.c:4600 [inline] kvm_arch_vcpu_put+0x34e/0x5b0 arch/x86/kvm/x86.c:4618 vcpu_put+0x1b/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:211 vmx_free_vcpu+0xcb/0x130 arch/x86/kvm/vmx/vmx.c:6985 kvm_arch_vcpu_destroy+0x76/0x290 arch/x86/kvm/x86.c:11219 kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline] The fix is to release the dirty page ring after kvm_arch_vcpu_destroy has run. Reported-by: Qiuhao Li <qiuhao@sysec.org> Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Yongkang Jia <kangel@zju.edu.cn> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-13 19:27:41 +02:00
..
async_pf.c	KVM: Add helpers to wake/query blocking vCPU	2021-12-08 04:24:54 -05:00
async_pf.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504	2019-06-19 17:09:56 +02:00
binary_stats.c	KVM: stats: remove dead stores	2021-08-13 03:35:15 -04:00
coalesced_mmio.c	KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio	2021-07-14 12:17:56 -04:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dirty_ring.c	KVM: Reinstate gfn_to_pfn_cache with invalidation support	2022-01-07 10:44:44 -05:00
eventfd.c	KVM: eventfd: Fix false positive RCU usage warning	2022-01-28 07:38:27 -05:00
irqchip.c	KVM/arm updates for 5.3	2019-07-11 15:14:16 +02:00
Kconfig	KVM: Reinstate gfn_to_pfn_cache with invalidation support	2022-01-07 10:44:44 -05:00
kvm_main.c	KVM: avoid NULL pointer dereference in kvm_dirty_ring_push	2022-04-13 19:27:41 +02:00
kvm_mm.h	KVM: Reinstate gfn_to_pfn_cache with invalidation support	2022-01-07 10:44:44 -05:00
Makefile.kvm	KVM: Reinstate gfn_to_pfn_cache with invalidation support	2022-01-07 10:44:44 -05:00
pfncache.c	KVM: avoid double put_page with gfn-to-pfn cache	2022-04-08 13:58:52 +02:00
vfio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00