Commit 987d1149 authored Dec 17, 2018 by Eric Biggers Committed by Paolo Bonzini Dec 18, 2018

KVM: fix unregistering coalesced mmio zone from wrong bus



If you register a kvm_coalesced_mmio_zone with '.pio = 0' but then
unregister it with '.pio = 1', KVM_UNREGISTER_COALESCED_MMIO will try to
unregister it from KVM_PIO_BUS rather than KVM_MMIO_BUS, which is a
no-op.  But it frees the kvm_coalesced_mmio_dev anyway, causing a
use-after-free.

Fix it by only unregistering and freeing the zone if the correct value
of 'pio' is provided.

Reported-by:  <syzbot+f87f60bb6f13f39b54e3@syzkaller.appspotmail.com>
Fixes: 0804c849 ("kvm/x86 : add coalesced pio support")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 7566ec39

virt/kvm/coalesced_mmio.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -175,10 +175,14 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
		{
		struct kvm_coalesced_mmio_dev dev, tmp;

		if (zone->pio != 1 && zone->pio != 0)
		return -EINVAL;

		mutex_lock(&kvm->slots_lock);

		list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list)
		if (coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
		if (zone->pio == dev->zone.pio &&
		coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
		kvm_io_bus_unregister_dev(kvm,
		zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
		kvm_iodevice_destructor(&dev->dev);

Admin message