Re: [PATCH] Revert "KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 1/24/23 00:06, Sean Christopherson wrote:
> On Wed, Jan 18, 2023, Michal Luczaj wrote:
>> Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
>> ---
>>  virt/kvm/coalesced_mmio.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
>> index 0be80c213f7f..f08f5e82460b 100644
>> --- a/virt/kvm/coalesced_mmio.c
>> +++ b/virt/kvm/coalesced_mmio.c
>> @@ -186,6 +186,7 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
>>  		    coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
>>  			r = kvm_io_bus_unregister_dev(kvm,
>>  				zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
>> +			kvm_iodevice_destructor(&dev->dev);
>>  
>>  			/*
>>  			 * On failure, unregister destroys all devices on the
>> @@ -195,7 +196,6 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
>>  			 */
>>  			if (r)
>>  				break;
>> -			kvm_iodevice_destructor(&dev->dev);
> 
> Already posted[1], but didn't get queued because there's alternative solution[2]
> that yields a far cleaner end result, albeit with a larger patch.  I'll follow
> up on Wei's patch to move things along.
> 
> [1] https://lore.kernel.org/all/20221219171924.67989-1-seanjc@xxxxxxxxxx
> [2] https://lore.kernel.org/all/20221229123302.4083-1-wei.w.wang@xxxxxxxxx

I apologise for the noise, I should have searched the archives before posting.

Michal





[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux