Paolo Bonzini 226b4327ef KVM: avoid NULL pointer dereference in kvm_dirty_ring_push ... commit 5593473a1e upstream. kvm_vcpu_release() will call kvm_dirty_ring_free(), freeing ring->dirty_gfns and setting it to NULL. Afterwards, it calls kvm_arch_vcpu_destroy(). However, if closing the file descriptor races with KVM_RUN in such away that vcpu->arch.st.preempted == 0, the following call stack leads to a NULL pointer dereference in kvm_dirty_run_push(): mark_page_dirty_in_slot+0x192/0x270 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3171 kvm_steal_time_set_preempted arch/x86/kvm/x86.c:4600 [inline] kvm_arch_vcpu_put+0x34e/0x5b0 arch/x86/kvm/x86.c:4618 vcpu_put+0x1b/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:211 vmx_free_vcpu+0xcb/0x130 arch/x86/kvm/vmx/vmx.c:6985 kvm_arch_vcpu_destroy+0x76/0x290 arch/x86/kvm/x86.c:11219 kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline] The fix is to release the dirty page ring after kvm_arch_vcpu_destroy has run. Reported-by: Qiuhao Li <qiuhao@sysec.org> Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Yongkang Jia <kangel@zju.edu.cn> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-13 20:59:26 +02:00
..
Kconfig	kvm: add PM-notifier	2021-06-17 13:09:32 -04:00
async_pf.c	mm/gup: remove task_struct pointer for all gup code	2020-08-12 10:58:04 -07:00
async_pf.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504	2019-06-19 17:09:56 +02:00
binary_stats.c	KVM: stats: remove dead stores	2021-08-13 03:35:15 -04:00
coalesced_mmio.c	KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio	2021-07-14 12:17:56 -04:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dirty_ring.c	KVM: Drop unused kvm_dirty_gfn_invalid()	2021-09-06 08:23:46 -04:00
eventfd.c	KVM: eventfd: Fix false positive RCU usage warning	2022-02-16 12:56:16 +01:00
irqchip.c	KVM/arm updates for 5.3	2019-07-11 15:14:16 +02:00
kvm_main.c	KVM: avoid NULL pointer dereference in kvm_dirty_ring_push	2022-04-13 20:59:26 +02:00
mmu_lock.h	KVM: x86/mmu: Use an rwlock for the x86 MMU	2021-02-04 05:27:43 -05:00
vfio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00