Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 6bbfb2653177a00f70e57e53625502d43804fed0

Authored by Michael S. Tsirkin
Committed by Marcelo Tosatti
1 parent c79bd89282

KVM: fix irqfd assign/deassign race 

I think I see the following (theoretical) race:

During irqfd assign, we drop irqfds lock before we
schedule inject work. Therefore, deassign running
on another CPU could cause shutdown and flush to run
before inject, causing user after free in inject.

A simple fix it to schedule inject under the lock.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gregory Haskins <ghaskins@novell.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Showing 1 changed file with 2 additions and 1 deletions Side-by-side Diff

... ... @@ -218,7 +218,6 @@
218 218 events = file->f_op->poll(file, &irqfd->pt);
219 219  
220 220 list_add_tail(&irqfd->list, &kvm->irqfds.items);
221   - spin_unlock_irq(&kvm->irqfds.lock);
222 221  
223 222 /*
224 223 * Check if there was an event already pending on the eventfd
... ... @@ -226,6 +225,8 @@
226 225 */
227 226 if (events & POLLIN)
228 227 schedule_work(&irqfd->inject);
  228 +
  229 + spin_unlock_irq(&kvm->irqfds.lock);
229 230  
230 231 /*
231 232 * do not drop the file until the irqfd is fully initialized, otherwise