kvm: use-after-free in irq_bypass_register_consumer

[Dmitry Vyukov]

Hello,

While running syzkaller fuzzer I got the following use-after-free report.
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11)


BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x3d1/0x420
at addr ffff88003b5d8820
Write of size 8 by task syz-executor/25573
CPU: 0 PID: 25573 Comm: syz-executor Not tainted 4.9.0-rc4+ #46
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88006caaf9e0 ffffffff81c2d79b ffff88003e80ccc0 ffff88003b5d86b8
 ffff88003b5d89f0 0000000000000001 ffff88006caafa08 ffffffff8165ab9c
 ffffed00076bb104 ffffed00076bb104 ffff88003e80ccc0 ffff88006caafa88
Call Trace:
 [<ffffffff8165b2b7>] __asan_report_store8_noabort+0x17/0x20
mm/kasan/report.c:334
 [<     inline     >] list_add include/linux/list.h:43
 [<ffffffff831d16d1>] irq_bypass_register_consumer+0x3d1/0x420
virt/lib/irqbypass.c:217
 [<     inline     >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:417
 [<ffffffff8106e3ea>] kvm_irqfd+0x109a/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 [<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
 [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2

Object at ffff88003b5d86b8, in cache kmalloc-512 size: 512

Allocated:
PID = 25573
 [  359.255946] [<     inline     >] kzalloc include/linux/slab.h:636
 [  359.255946] [<     inline     >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:296
 [  359.255946] [<ffffffff8106d3f7>] kvm_irqfd+0xa7/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 [  359.255946] [<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
 [  359.255946] [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [  359.255946] [<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
 [  359.255946] [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [  359.255946] [<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [  359.255946] [<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2

Freed:
PID = 1057
 [  359.255946] [<ffffffff8165696a>] kfree+0xea/0x2c0 mm/slub.c:3871
 [  359.255946] [<ffffffff8106d16d>] irqfd_shutdown+0x13d/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:148
 [  359.255946] [<ffffffff8129175c>] process_one_work+0x9fc/0x1900
kernel/workqueue.c:2096
 [  359.255946] [<ffffffff8129274f>] worker_thread+0xef/0x1480
kernel/workqueue.c:2230
 [  359.386293] [<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
 [  359.387074] [<ffffffff831ea02a>] ret_from_fork+0x2a/0x40
arch/x86/entry/entry_64.S:433