tree 9663e651c1a1d5ea7f4134029f30be405e65fd10
parent e63303e63cdcc3ae6fd51c39e3400f58c43fee55
author Paolo Bonzini <pbonzini@redhat.com> 1527507073 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1535109161 +0200

KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer

commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.

A comment warning against this bug is there, but the code is not doing what
the comment says.  Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer.  The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.

Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>