Re: [RFC PATCH 1/2] KVM: x86/xen: Fix use-after-free in kvm_xen_eventfd_update()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 12/22/22 21:30, Michal Luczaj wrote:
+	idx = srcu_read_lock(&kvm->srcu);
+
  	mutex_lock(&kvm->lock);
  	evtchnfd = idr_find(&kvm->arch.xen.evtchn_ports, port);
  	mutex_unlock(&kvm->lock);

This lock/unlock pair can cause a deadlock because it's inside the SRCU read side critical section. Fortunately it's simpler to just use mutex_lock for the whole function instead of using two small critical sections, and then SRCU is not needed.

However, the same issue exists in kvm_xen_hcall_evtchn_send where idr_find is not protected by kvm->lock. In that case, it is important to use rcu_read_lock/unlock() around it, because idr_remove() will *not* use synchronize_srcu() to wait for readers to complete.

Paolo




[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux