Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933349AbdC3KBS (ORCPT ); Thu, 30 Mar 2017 06:01:18 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:52768 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932302AbdC3KBQ (ORCPT ); Thu, 30 Mar 2017 06:01:16 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , Xiao Guangrong , Paolo Bonzini Subject: [PATCH 4.10 05/17] KVM: x86: cleanup the page tracking SRCU instance Date: Thu, 30 Mar 2017 12:00:20 +0200 Message-Id: <20170330095926.727368365@linuxfoundation.org> X-Mailer: git-send-email 2.12.1 In-Reply-To: <20170330095925.918515862@linuxfoundation.org> References: <20170330095925.918515862@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1964 Lines: 62 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paolo Bonzini commit 2beb6dad2e8f95d710159d5befb390e4f62ab5cf upstream. SRCU uses a delayed work item. Skip cleaning it up, and the result is use-after-free in the work item callbacks. Reported-by: Dmitry Vyukov Suggested-by: Dmitry Vyukov Fixes: 0eb05bf290cfe8610d9680b49abef37febd1c38a Reviewed-by: Xiao Guangrong Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/kvm_page_track.h | 1 + arch/x86/kvm/page_track.c | 8 ++++++++ arch/x86/kvm/x86.c | 1 + 3 files changed, 10 insertions(+) --- a/arch/x86/include/asm/kvm_page_track.h +++ b/arch/x86/include/asm/kvm_page_track.h @@ -46,6 +46,7 @@ struct kvm_page_track_notifier_node { }; void kvm_page_track_init(struct kvm *kvm); +void kvm_page_track_cleanup(struct kvm *kvm); void kvm_page_track_free_memslot(struct kvm_memory_slot *free, struct kvm_memory_slot *dont); --- a/arch/x86/kvm/page_track.c +++ b/arch/x86/kvm/page_track.c @@ -158,6 +158,14 @@ bool kvm_page_track_is_active(struct kvm return !!ACCESS_ONCE(slot->arch.gfn_track[mode][index]); } +void kvm_page_track_cleanup(struct kvm *kvm) +{ + struct kvm_page_track_notifier_head *head; + + head = &kvm->arch.track_notifier_head; + cleanup_srcu_struct(&head->track_srcu); +} + void kvm_page_track_init(struct kvm *kvm) { struct kvm_page_track_notifier_head *head; --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8052,6 +8052,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm kvm_free_vcpus(kvm); kvfree(rcu_dereference_check(kvm->arch.apic_map, 1)); kvm_mmu_uninit_vm(kvm); + kvm_page_track_cleanup(kvm); } void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,