Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1757758AbcJXPXd (ORCPT <rfc822;w@1wt.eu>);
        Mon, 24 Oct 2016 11:23:33 -0400
Received: from mx1.redhat.com ([209.132.183.28]:62730 "EHLO mx1.redhat.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1757718AbcJXPXa (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 24 Oct 2016 11:23:30 -0400
Date: Mon, 24 Oct 2016 17:23:26 +0200
From: Radim =?utf-8?B?S3LEjW3DocWZ?= <rkrcmar@redhat.com>
To: Ido Yariv <ido@wizery.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, x86@kernel.org, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free
Message-ID: <20161024152325.GD2247@potion>
References: <1477067997-17845-1-git-send-email-ido@wizery.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1477067997-17845-1-git-send-email-ido@wizery.com>
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Mon, 24 Oct 2016 15:23:30 +0000 (UTC)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 476
Lines: 17

2016-10-21 12:39-0400, Ido Yariv:
> vcpu->arch.wbinvd_dirty_mask may still be used after freeing it,
> corrupting memory. For example, the following call trace may set a bit
> in an already freed cpu mask:
>     kvm_arch_vcpu_load
>     vcpu_load
>     vmx_free_vcpu_nested
>     vmx_free_vcpu
>     kvm_arch_vcpu_free
> 
> Fix this by deferring freeing of wbinvd_dirty_mask.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Ido Yariv <ido@wizery.com>
> ---

Applied, thanks.