Skip to content
  • Wanpeng Li's avatar
    KVM: eventfd: fix NULL deref irqbypass consumer · 4f3dbdf4
    Wanpeng Li authored
    Reported syzkaller:
    
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
        IP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass]
        PGD 0
    
        Oops: 0002 [#1] SMP
        CPU: 1 PID: 125 Comm: kworker/1:1 Not tainted 4.9.0+ #1
        Workqueue: kvm-irqfd-cleanup irqfd_shutdown [kvm]
        task: ffff9bbe0dfbb900 task.stack: ffffb61802014000
        RIP: 0010:irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass]
        Call Trace:
         irqfd_shutdown+0x66/0xa0 [kvm]
         process_one_work+0x16b/0x480
         worker_thread+0x4b/0x500
         kthread+0x101/0x140
         ? process_one_work+0x480/0x480
         ? kthread_create_on_node+0x60/0x60
         ret_from_fork+0x25/0x30
        RIP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] RSP: ffffb61802017e20
        CR2: 0000000000000008
    
    The syzkaller folks reported a NULL pointer dereference that due to
    unregister an consumer which fails registration before. The syzkaller
    creates two VMs w/ an equal eventfd occasi...
    4f3dbdf4