kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/virt/kvm
History
Jann Horn 2aa9f75791 kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) 
commit cfa3938117 upstream.

kvm_ioctl_create_device() does the following:

1. creates a device that holds a reference to the VM object (with a borrowed
   reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
   reference

The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.

This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.

Fixes: 852b6d57dc ("kvm: add device control API")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-03-25 17:32:35 +00:00
..
arm KVM: Protect device ops->create and list_add with kvm->lock 2019-03-25 17:32:35 +00:00
assigned-dev.c kvm: Use pci_enable_msix_exact() instead of pci_enable_msix() 2014-04-28 11:13:06 +02:00
async_pf.c KVM: async_pf: do not warn on page allocation failures 2016-03-08 12:15:30 +00:00
async_pf.h KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
coalesced_mmio.c KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio() 2014-01-30 11:56:09 +01:00
coalesced_mmio.h KVM: Make coalesced mmio use a device per zone 2011-09-25 19:17:57 +03:00
eventfd.c KVM: kvm_io_bus_unregister_dev() should never fail 2017-07-18 18:40:22 +01:00
ioapic.c KVM: x86: always exit on EOIs for interrupts listed in the IOAPIC redir table 2014-09-05 16:36:32 -07:00
ioapic.h kvm: make local functions static 2014-01-08 19:02:58 -02:00
iodev.h KVM: remove in_range from io devices 2009-09-10 08:33:05 +03:00
iommu.c kvm: fix excessive pages un-pinning in kvm_iommu_map error path. 2014-11-05 11:43:13 +00:00
irq_comm.c kvm/irqchip: Speed up KVM_SET_GSI_ROUTING 2014-05-05 16:29:11 +02:00
irqchip.c KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi 2016-08-22 22:38:08 +01:00
Kconfig KVM: async_pf: Provide additional direct page notification 2014-01-30 12:51:38 +01:00
kvm_main.c kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) 2019-03-25 17:32:35 +00:00
vfio.c vfio: New external user group/file match 2017-10-12 15:27:55 +01:00