Paolo Bonzini d56f5136b0 KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories ... After commit 63d0434 ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point") we are creating the pre-vCPU debugfs files after the creation of the vCPU file descriptor. This makes it possible for userspace to reach kvm_vcpu_release before kvm_create_vcpu_debugfs has finished. The vcpu->debugfs_dentry then does not have any associated inode anymore, and this causes a NULL-pointer dereference in debugfs_create_file. The solution is simply to avoid removing the files; they are cleaned up when the VM file descriptor is closed (and that must be after KVM_CREATE_VCPU returns). We can stop storing the dentry in struct kvm_vcpu too, because it is not needed anywhere after kvm_create_vcpu_debugfs returns. Reported-by: syzbot+705f4401d5a93a59b87d@syzkaller.appspotmail.com Fixes: 63d0434837 ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point") Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2020-06-04 11:00:54 -04:00
..
async_pf.c	KVM: x86: acknowledgment mechanism for async pf page ready notifications	2020-06-01 04:26:08 -04:00
async_pf.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504	2019-06-19 17:09:56 +02:00
coalesced_mmio.c	KVM: Fix spelling in code comments	2020-05-16 15:05:01 +01:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
eventfd.c	KVM/arm64 updates for Linux 5.8:	2020-06-01 04:26:27 -04:00
irqchip.c	KVM/arm updates for 5.3	2019-07-11 15:14:16 +02:00
Kconfig	KVM: polling: add architecture backend to disable polling	2019-04-26 09:08:17 +02:00
kvm_main.c	KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories	2020-06-04 11:00:54 -04:00
vfio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00