Re: [PATCH] kvm: Prevent kvm_init from corrupting debugfs structures
On Wed, Oct 14, 2009 at 04:21:00PM -0700, Darrick J. Wong wrote: > I'm seeing an oops condition when kvm-intel and kvm-amd are modprobe'd > during boot (say on an Intel system) and then rmmod'd: > ># modprobe kvm-intel > kvm_init() > kvm_init_debug() > kvm_arch_init() <-- stores debugfs dentries internally > (success, etc) > ># modprobe kvm-amd > kvm_init() > kvm_init_debug() <-- second initialization clobbers kvm's > internal pointers to dentries > kvm_arch_init() > kvm_exit_debug() <-- and frees them > ># rmmod kvm-intel > kvm_exit() > kvm_exit_debug() <-- double free of debugfs files! > > *BOOM* > > If execution gets to the end of kvm_init(), then the calling module has been > established as the kvm provider. Move the debugfs initialization to the end > of > the function, and remove the now-unnecessary call to kvm_exit_debug() from the > error path. That way we avoid trampling on the debugfs entries and freeing > them twice. > > Signed-off-by: Darrick J. Wong Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] kvm: Prevent kvm_init from corrupting debugfs structures
On 10/15/2009 08:21 AM, Darrick J. Wong wrote: I'm seeing an oops condition when kvm-intel and kvm-amd are modprobe'd during boot (say on an Intel system) and then rmmod'd: # modprobe kvm-intel kvm_init() kvm_init_debug() kvm_arch_init()<-- stores debugfs dentries internally (success, etc) # modprobe kvm-amd kvm_init() kvm_init_debug()<-- second initialization clobbers kvm's internal pointers to dentries kvm_arch_init() kvm_exit_debug()<-- and frees them # rmmod kvm-intel kvm_exit() kvm_exit_debug()<-- double free of debugfs files! *BOOM* If execution gets to the end of kvm_init(), then the calling module has been established as the kvm provider. Move the debugfs initialization to the end of the function, and remove the now-unnecessary call to kvm_exit_debug() from the error path. That way we avoid trampling on the debugfs entries and freeing them twice. Looks good. -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
