Paolo Bonzini 270d5d7719 KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer ... commit 9432a31757 upstream. A comment warning against this bug is there, but the code is not doing what the comment says. Therefore it is possible that an EPOLLHUP races against irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown, and if that runs soon enough, you get a use-after-free. Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-08-24 13:09:21 +02:00
..
kvm	KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer	2018-08-24 13:09:21 +02:00
lib	KVM: eventfd: fix NULL deref irqbypass consumer	2017-01-12 14:42:34 +01:00
Makefile	virt: Add virt directory to the top Makefile	2015-10-01 15:06:44 +02:00