• Jann Horn's avatar
    kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) · bc4db524
    Jann Horn authored
    commit cfa39381173d5f969daf43582c95ad679189cbc9 upstream.
    
    kvm_ioctl_create_device() does the following:
    
    1. creates a device that holds a reference to the VM object (with a borrowed
       reference, the VM's refcount has not been bumped yet)
    2. initializes the device
    3. transfers the reference to the device to the caller's file descriptor table
    4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
       reference
    
    The ownership transfer in step 3 must not happen before the reference to the VM
    becomes a proper, non-borrowed reference, which only happens in step 4.
    After step 3, an attacker can close the file descriptor and drop the borrowed
    reference, which can cause the refcount of the kvm object to drop to zero.
    
    This means that we need to grab a reference for the device before
    anon_inode_getfd(), otherwise the VM can disappear from under us.
    
    Fixes: 852b6d57 ("kvm: add device control API")
    Cc: stable@kernel.org
    Signed-off-by: 's avatarJann Horn <jannh@google.com>
    Signed-off-by: 's avatarPaolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    bc4db524
Name
Last commit
Last update
Documentation Loading commit data...
arch Loading commit data...
block Loading commit data...
certs Loading commit data...
crypto Loading commit data...
drivers Loading commit data...
firmware Loading commit data...
fs Loading commit data...
include Loading commit data...
init Loading commit data...
ipc Loading commit data...
kernel Loading commit data...
lib Loading commit data...
mm Loading commit data...
net Loading commit data...
samples Loading commit data...
scripts Loading commit data...
security Loading commit data...
sound Loading commit data...
tools Loading commit data...
usr Loading commit data...
virt Loading commit data...
.get_maintainer.ignore Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Kbuild Loading commit data...
Kconfig Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README Loading commit data...
REPORTING-BUGS Loading commit data...