• Paolo Bonzini's avatar
    KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories · d56f5136
    Paolo Bonzini authored
    After commit 63d04348 ("KVM: x86: move kvm_create_vcpu_debugfs after
    last failure point") we are creating the pre-vCPU debugfs files
    after the creation of the vCPU file descriptor.  This makes it
    possible for userspace to reach kvm_vcpu_release before
    kvm_create_vcpu_debugfs has finished.  The vcpu->debugfs_dentry
    then does not have any associated inode anymore, and this causes
    a NULL-pointer dereference in debugfs_create_file.
    
    The solution is simply to avoid removing the files; they are
    cleaned up when the VM file descriptor is closed (and that must be
    after KVM_CREATE_VCPU returns).  We can stop storing the dentry
    in struct kvm_vcpu too, because it is not needed anywhere after
    kvm_create_vcpu_debugfs returns.
    
    Reported-by: syzbot+705f4401d5a93a59b87d@syzkaller.appspotmail.com
    Fixes: 63d04348 ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point")
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    d56f5136
kvm_main.c 118 KB