5.4-stable patches

added patches:
	kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch

diff --git a/queue-5.4/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch b/queue-5.4/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch
new file mode 100644 (file)
index 0000000..f0696f3
--- /dev/null
+++ b/queue-5.4/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch
@@ -0,0 +1,74 @@
+From b1cb1fac22abf102ffeb29dd3eeca208a3869d54 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Mon, 19 Dec 2022 17:19:24 +0000
+Subject: KVM: Destroy target device if coalesced MMIO unregistration fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit b1cb1fac22abf102ffeb29dd3eeca208a3869d54 upstream.
+
+Destroy and free the target coalesced MMIO device if unregistering said
+device fails.  As clearly noted in the code, kvm_io_bus_unregister_dev()
+does not destroy the target device.
+
+  BUG: memory leak
+  unreferenced object 0xffff888112a54880 (size 64):
+    comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s)
+    hex dump (first 32 bytes):
+      38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff  8.g.....8.g.....
+      e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff  .........0g.....
+    backtrace:
+      [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline]
+      [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline]
+      [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150
+      [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323
+      [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline]
+      [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline]
+      [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696
+      [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713
+      [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline]
+      [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline]
+      [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
+      [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290
+      [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+  BUG: leak checking failed
+
+Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed")
+Cc: stable@vger.kernel.org
+Reported-by: 柳菁峰 <liujingfeng@qianxin.com>
+Reported-by: Michal Luczaj <mhal@rbox.co>
+Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com
+Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/coalesced_mmio.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/virt/kvm/coalesced_mmio.c
++++ b/virt/kvm/coalesced_mmio.c
+@@ -191,15 +191,17 @@ int kvm_vm_ioctl_unregister_coalesced_mm
+                       r = kvm_io_bus_unregister_dev(kvm,
+                               zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
+ 
++                      kvm_iodevice_destructor(&dev->dev);
++
+                       /*
+                        * On failure, unregister destroys all devices on the
+                        * bus _except_ the target device, i.e. coalesced_zones
+-                       * has been modified.  No need to restart the walk as
+-                       * there aren't any zones left.
++                       * has been modified.  Bail after destroying the target
++                       * device, there's no need to restart the walk as there
++                       * aren't any zones left.
+                        */
+                       if (r)
+                               break;
+-                      kvm_iodevice_destructor(&dev->dev);
+               }
+       }
+ 

diff --git a/queue-5.4/series b/queue-5.4/series
index c4b5e7b30c89f11260e541c1f742e1cf644afdff..35e96c0e634f9c17e578b53fd4971e821a9842e5 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -231,3 +231,4 @@ udf-do-not-update-file-length-for-failed-writes-to-inline-files.patch
 udf-preserve-link-count-of-system-files.patch
 udf-detect-system-inodes-linked-into-directory-hierarchy.patch
 udf-fix-file-corruption-when-appending-just-after-end-of-preallocated-extent.patch
+kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch