From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752915AbdLMB5V (ORCPT ); Tue, 12 Dec 2017 20:57:21 -0500 Received: from fldsmtpe03.verizon.com ([140.108.26.142]:57985 "EHLO fldsmtpe03.verizon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752348AbdLMB46 (ORCPT ); Tue, 12 Dec 2017 20:56:58 -0500 From: alexander.levin@verizon.com Cc: Dmitry Vyukov , Joerg Roedel , "Paolo Bonzini" , =?utf-8?B?UmFkaW0gS3LEjW3DocWZ?= , David Hildenbrand , "kvm@vger.kernel.org" , "syzkaller@googlegroups.com" , alexander.levin@verizon.com X-Host: pioneer.tdc.vzwcorp.com To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH AUTOSEL for 4.9 004/100] kvm: fix usage of uninit spinlock in avic_vm_destroy() Thread-Topic: [PATCH AUTOSEL for 4.9 004/100] kvm: fix usage of uninit spinlock in avic_vm_destroy() Thread-Index: AQHTc7WOuAcjIFI38UGWIs5rSNse2A== Date: Wed, 13 Dec 2017 01:56:14 +0000 Message-ID: <20171213015606.6568-4-alexander.levin@verizon.com> References: <20171213015606.6568-1-alexander.levin@verizon.com> In-Reply-To: <20171213015606.6568-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-Type: text/plain; charset="utf-8" Content-ID: <553185A4ECD10A48BF459508AD1999A0@vzwcorp.com> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id vBD1vXAW014784 From: Dmitry Vyukov [ Upstream commit 3863dff0c3dd72984395c93b12383b393c5c3989 ] If avic is not enabled, avic_vm_init() does nothing and returns early. However, avic_vm_destroy() still tries to destroy what hasn't been created. The only bad consequence of this now is that avic_vm_destroy() uses svm_vm_data_hash_lock that hasn't been initialized (and is not meant to be used at all if avic is not enabled). Return early from avic_vm_destroy() if avic is not enabled. It has nothing to destroy. Signed-off-by: Dmitry Vyukov Cc: Joerg Roedel Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: David Hildenbrand Cc: kvm@vger.kernel.org Cc: syzkaller@googlegroups.com Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář Signed-off-by: Sasha Levin --- arch/x86/kvm/svm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 23f1a6bd7a0d..8148d8ca7930 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1382,6 +1382,9 @@ static void avic_vm_destroy(struct kvm *kvm) unsigned long flags; struct kvm_arch *vm_data = &kvm->arch; + if (!avic) + return; + avic_free_vm_id(vm_data->avic_vm_id); if (vm_data->avic_logical_id_table_page) -- 2.11.0