diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2018-05-28 13:31:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-08-24 13:27:00 +0200 |
| commit | 1186a6ea75df00ec27b9cf2c5d0a5e4298739301 (patch) | |
| tree | fcc709dcdb09c69cbf4943091ec51aa840c382c6 /lib/debugobjects.c | |
| parent | b84ec04bae905901f5226a67968dabc52ab0c3a6 (diff) | |
KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.
A comment warning against this bug is there, but the code is not doing what
the comment says. Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions