From: Juergen Gross <jgross@suse.com>
To: Viresh Kumar <viresh.kumar@linaro.org>,
Stefano Stabellini <sstabellini@kernel.org>,
Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Cc: "Vincent Guittot" <vincent.guittot@linaro.org>,
"Alex Bennée" <alex.bennee@linaro.org>,
"Manos Pitsidianakis" <manos.pitsidianakis@linaro.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Al Viro" <viro@zeniv.linux.org.uk>,
xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/2] xen: privcmd: Fix possible access to a freed kirqfd instance
Date: Tue, 2 Jul 2024 12:15:57 +0200 [thread overview]
Message-ID: <caa4f006-6c74-4e16-961f-23ea90e26606@suse.com> (raw)
In-Reply-To: <9e884af1f1f842eacbb7afc5672c8feb4dea7f3f.1718703669.git.viresh.kumar@linaro.org>
[-- Attachment #1.1.1: Type: text/plain, Size: 835 bytes --]
On 18.06.24 11:42, Viresh Kumar wrote:
> Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and
> privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd
> created and added to the irqfds_list by privcmd_irqfd_assign() may get
> removed by another thread executing privcmd_irqfd_deassign(), while the
> former is still using it after dropping the locks.
>
> This can lead to a situation where an already freed kirqfd instance may
> be accessed and cause kernel oops.
>
> Use SRCU locking to prevent the same, as is done for the KVM
> implementation for irqfds.
>
> Reported-by: Al Viro <viro@zeniv.linux.org.uk>
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
next prev parent reply other threads:[~2024-07-02 10:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-18 9:42 [PATCH 1/2] xen: privcmd: Switch from mutex to spinlock for irqfds Viresh Kumar
2024-06-18 9:42 ` [PATCH 2/2] xen: privcmd: Fix possible access to a freed kirqfd instance Viresh Kumar
2024-07-02 10:15 ` Juergen Gross [this message]
2024-07-02 10:12 ` [PATCH 1/2] xen: privcmd: Switch from mutex to spinlock for irqfds Juergen Gross
2024-07-02 10:17 ` Viresh Kumar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=caa4f006-6c74-4e16-961f-23ea90e26606@suse.com \
--to=jgross@suse.com \
--cc=alex.bennee@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=manos.pitsidianakis@linaro.org \
--cc=oleksandr_tyshchenko@epam.com \
--cc=pbonzini@redhat.com \
--cc=sstabellini@kernel.org \
--cc=vincent.guittot@linaro.org \
--cc=viresh.kumar@linaro.org \
--cc=viro@zeniv.linux.org.uk \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®