Skip to contentSkip to conversation

KVM: use after free in kvm_ioctl_create_device()

PATCH Applied Dan Carpenter 3 participants 3 messages Nov 30, 2016 – Dec 1, 2016

Subsystems (2)
KVM Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 KVM: use after free in kvm_ioctl_create_device()

We should move the ops->destroy(dev) after the list_del(&dev->vm_node) so that we don't use "dev" after freeing it.

Fixes a28ebea2adc4 ("KVM: Protect device ops->create and list_add with kvm->lock")
Signed-off-by Dan Carpenter <[email protected]>
virt/kvm/kvm_main.c +1 -1
index 69a1247..de102ca 100644
@@ -2899,10 +2899,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
-		ops->destroy(dev);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
+		ops->destroy(dev);
 		return ret;
 	}
Reviewed-by on v1 1/1
#1 lore raw

Am 30.11.2016 um 20:21 schrieb Dan Carpenter:

virt/kvm/kvm_main.c static int kvm_ioctl_create_device(struct kvm *kvm,

Quoted 11 lines

We should move the ops->destroy(dev) after the list_del(&dev->vm_node) so that we don't use "dev" after freeing it.

Fixes a28ebea2adc4 ("KVM: Protect device ops->create and list_add with kvm->lock")
Signed-off-by Dan Carpenter <[email protected]>
virt/kvm/kvm_main.c +0 -0
index 69a1247..de102ca 100644
@@ -2899,10 +2899,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,

Looks sane to me! This also matches kvm_destroy_devices().

Reviewed-by David Hildenbrand <[email protected]>
Signature · 1 line
David