• P
    KVM: fix placement of refcount initialization · e2d3fcaf
    Paolo Bonzini 提交于
    Reported by syzkaller:
    
       =============================
       WARNING: suspicious RCU usage
       -----------------------------
       ./include/linux/kvm_host.h:536 suspicious rcu_dereference_check() usage!
    
       other info that might help us debug this:
    
       rcu_scheduler_active = 2, debug_locks = 1
       no locks held by repro_11/12688.
    
       stack backtrace:
       Call Trace:
        dump_stack+0x7d/0xc5
        lockdep_rcu_suspicious+0x123/0x170
        kvm_dev_ioctl+0x9a9/0x1260 [kvm]
        do_vfs_ioctl+0x1a1/0xfb0
        ksys_ioctl+0x6d/0x80
        __x64_sys_ioctl+0x73/0xb0
        do_syscall_64+0x108/0xaa0
        entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Commit a97b0e77 (kvm: call kvm_arch_destroy_vm if vm creation fails)
    sets users_count to 1 before kvm_arch_init_vm(), however, if kvm_arch_init_vm()
    fails, we need to decrease this count.  By moving it earlier, we can push
    the decrease to out_err_no_arch_destroy_vm without introducing yet another
    error label.
    
    syzkaller source: https://syzkaller.appspot.com/x/repro.c?x=15209b84e00000
    
    Reported-by: syzbot+75475908cd0910f141ee@syzkaller.appspotmail.com
    Fixes: a97b0e77 ("kvm: call kvm_arch_destroy_vm if vm creation fails")
    Cc: Jim Mattson <jmattson@google.com>
    Analyzed-by: NWanpeng Li <wanpengli@tencent.com>
    Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
    e2d3fcaf
kvm_main.c 102.2 KB