On Wed, 2019-11-27 at 17:40 +0100, Paolo Bonzini wrote:
> > diff --git a/arch/powerpc/kvm/book3s_64_vio.c
> > b/arch/powerpc/kvm/book3s_64_vio.c
> > index 5834db0a54c6..a402ead833b6 100644
> > --- a/arch/powerpc/kvm/book3s_64_vio.c
> > +++ b/arch/powerpc/kvm/book3s_64_vio.c
> > @@ -316,14 +316,13
On Thu, 2019-11-28 at 09:57 +1100, Paul Mackerras wrote:
> There isn't a potential use-after-free here. We are relying on the
> property that the release function (kvm_vm_release) cannot be called
> in parallel with this function. The reason is that this function
> (kvm_vm_ioctl_create_spapr_tce)
On Tue, Nov 26, 2019 at 02:52:12PM -0300, Leonardo Bras wrote:
> Fixes a possible 'use after free' of kvm variable.
> It does use mutex_unlock(&kvm->lock) after possible freeing a variable
> with kvm_put_kvm(kvm).
Comments below...
> diff --git a/arch/powerpc/kvm/book3s_64_vio.c
> b/arch/powerpc
On 26/11/19 18:52, Leonardo Bras wrote:
> Fixes a possible 'use after free' of kvm variable.
> It does use mutex_unlock(&kvm->lock) after possible freeing a variable
> with kvm_put_kvm(kvm).
>
> Signed-off-by: Leonardo Bras
> ---
> arch/powerpc/kvm/book3s_64_vio.c | 3 +--
> virt/kvm/kvm_main.c
On Wed, 2019-11-27 at 17:40 +0100, Paolo Bonzini wrote:
> >
> >if (ret >= 0)
> >list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
> > - else
> > - kvm_put_kvm(kvm);
> >
> >mutex_unlock(&kvm->lock);
> >
> >if (ret >= 0)
> >
On Tue, Nov 26, 2019 at 02:52:12PM -0300, Leonardo Bras wrote:
> Fixes a possible 'use after free' of kvm variable.
> It does use mutex_unlock(&kvm->lock) after possible freeing a variable
> with kvm_put_kvm(kvm).
Moving the calls to kvm_put_kvm() to the end of the functions doesn't
actually fix a
Fixes a possible 'use after free' of kvm variable.
It does use mutex_unlock(&kvm->lock) after possible freeing a variable
with kvm_put_kvm(kvm).
Signed-off-by: Leonardo Bras
---
arch/powerpc/kvm/book3s_64_vio.c | 3 +--
virt/kvm/kvm_main.c | 8
2 files changed, 5 insertions
