From: Greg Kroah-Hartman Date: Mon, 6 Mar 2023 17:16:18 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v6.2.3~82 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=346ed7328939353ad2ffe1a4b443f959b750695c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch --- diff --git a/queue-5.15/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch b/queue-5.15/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch new file mode 100644 index 00000000000..a08cc3f625c --- /dev/null +++ b/queue-5.15/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch @@ -0,0 +1,74 @@ +From b1cb1fac22abf102ffeb29dd3eeca208a3869d54 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Mon, 19 Dec 2022 17:19:24 +0000 +Subject: KVM: Destroy target device if coalesced MMIO unregistration fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sean Christopherson + +commit b1cb1fac22abf102ffeb29dd3eeca208a3869d54 upstream. + +Destroy and free the target coalesced MMIO device if unregistering said +device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() +does not destroy the target device. + + BUG: memory leak + unreferenced object 0xffff888112a54880 (size 64): + comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) + hex dump (first 32 bytes): + 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... + e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... + backtrace: + [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] + [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] + [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 + [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 + [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] + [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] + [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 + [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 + [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] + [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] + [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 + [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 + [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + + BUG: leak checking failed + +Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed") +Cc: stable@vger.kernel.org +Reported-by: 柳菁峰 +Reported-by: Michal Luczaj +Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com +Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/coalesced_mmio.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/virt/kvm/coalesced_mmio.c ++++ b/virt/kvm/coalesced_mmio.c +@@ -187,15 +187,17 @@ int kvm_vm_ioctl_unregister_coalesced_mm + r = kvm_io_bus_unregister_dev(kvm, + zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev); + ++ kvm_iodevice_destructor(&dev->dev); ++ + /* + * On failure, unregister destroys all devices on the + * bus _except_ the target device, i.e. coalesced_zones +- * has been modified. No need to restart the walk as +- * there aren't any zones left. ++ * has been modified. Bail after destroying the target ++ * device, there's no need to restart the walk as there ++ * aren't any zones left. + */ + if (r) + break; +- kvm_iodevice_destructor(&dev->dev); + } + } + diff --git a/queue-5.15/series b/queue-5.15/series index 5307fddd04f..28d79149900 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -464,3 +464,4 @@ udf-preserve-link-count-of-system-files.patch udf-detect-system-inodes-linked-into-directory-hierarchy.patch udf-fix-file-corruption-when-appending-just-after-end-of-preallocated-extent.patch rdma-siw-fix-user-page-pinning-accounting.patch +kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch