Re: [PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-24 Thread Radim Krčmář
2016-10-21 12:39-0400, Ido Yariv: > vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, > corrupting memory. For example, the following call trace may set a bit > in an already freed cpu mask: > kvm_arch_vcpu_load > vcpu_load > vmx_free_vcpu_nested > vmx_free_vcpu >

Re: [PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-24 Thread Radim Krčmář
2016-10-21 12:39-0400, Ido Yariv: > vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, > corrupting memory. For example, the following call trace may set a bit > in an already freed cpu mask: > kvm_arch_vcpu_load > vcpu_load > vmx_free_vcpu_nested > vmx_free_vcpu >

Re: [PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-24 Thread Paolo Bonzini
On 21/10/2016 18:39, Ido Yariv wrote: > vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, > corrupting memory. For example, the following call trace may set a bit > in an already freed cpu mask: > kvm_arch_vcpu_load > vcpu_load > vmx_free_vcpu_nested >

Re: [PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-24 Thread Paolo Bonzini
On 21/10/2016 18:39, Ido Yariv wrote: > vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, > corrupting memory. For example, the following call trace may set a bit > in an already freed cpu mask: > kvm_arch_vcpu_load > vcpu_load > vmx_free_vcpu_nested >

[PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-21 Thread Ido Yariv
vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, corrupting memory. For example, the following call trace may set a bit in an already freed cpu mask: kvm_arch_vcpu_load vcpu_load vmx_free_vcpu_nested vmx_free_vcpu kvm_arch_vcpu_free Fix this by deferring

[PATCH] KVM: x86: fix wbinvd_dirty_mask use-after-free

2016-10-21 Thread Ido Yariv
vcpu->arch.wbinvd_dirty_mask may still be used after freeing it, corrupting memory. For example, the following call trace may set a bit in an already freed cpu mask: kvm_arch_vcpu_load vcpu_load vmx_free_vcpu_nested vmx_free_vcpu kvm_arch_vcpu_free Fix this by deferring