Gil Kupfer
d9bc59c44d
vmw_balloon: fixing double free when batching mode is off
commit b23220fe054e92f616b82450fae8cd3ab176cc60 upstream.
The balloon.page field is used for two different purposes if batching is
on or off. If batching is on, the field point to the page which is used
to communicate with with the hypervisor. If it is off, balloon.page
points to the page that is about to be (un)locked.
Unfortunately, this dual-purpose of the field introduced a bug: when the
balloon is popped (e.g., when the machine is reset or the balloon driver
is explicitly removed), the balloon driver frees, unconditionally, the
page that is held in balloon.page. As a result, if batching is
disabled, this leads to double freeing the last page that is sent to the
hypervisor.
The following error occurs during rmmod when kernel checkers are on, and
the balloon is not empty:
[ 42.307653] ------------[ cut here ]------------
[ 42.307657] Kernel BUG at ffffffffba1e4b28 [verbose debug info unavailable]
[ 42.307720] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 42.312512] Modules linked in: vmw_vsock_vmci_transport vsock ppdev joydev vmw_balloon(-) input_leds serio_raw vmw_vmci parport_pc shpchp parport i2c_piix4 nfit mac_hid autofs4 vmwgfx drm_kms_helper hid_generic syscopyarea sysfillrect usbhid sysimgblt fb_sys_fops hid ttm mptspi scsi_transport_spi ahci mptscsih drm psmouse vmxnet3 libahci mptbase pata_acpi
[ 42.312766] CPU: 10 PID: 1527 Comm: rmmod Not tainted 4.12.0+ #5
[ 42.312803] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 09/30/2016
[ 42.313042] task: ffff9bf9680f8000 task.stack: ffffbfefc1638000
[ 42.313290] RIP: 0010:__free_pages+0x38/0x40
[ 42.313510] RSP: 0018:ffffbfefc163be98 EFLAGS: 00010246
[ 42.313731] RAX: 000000000000003e RBX: ffffffffc02b9720 RCX: 0000000000000006
[ 42.313972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9bf97e08e0a0
[ 42.314201] RBP: ffffbfefc163be98 R08: 0000000000000000 R09: 0000000000000000
[ 42.314435] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc02b97e4
[ 42.314505] R13: ffffffffc02b9748 R14: ffffffffc02b9728 R15: 0000000000000200
[ 42.314550] FS: 00007f3af5fec700(0000) GS:ffff9bf97e080000(0000) knlGS:0000000000000000
[ 42.314599] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 42.314635] CR2: 00007f44f6f4ab24 CR3: 00000003a7d12000 CR4: 00000000000006e0
[ 42.314864] Call Trace:
[ 42.315774] vmballoon_pop+0x102/0x130 [vmw_balloon]
[ 42.315816] vmballoon_exit+0x42/0xd64 [vmw_balloon]
[ 42.315853] SyS_delete_module+0x1e2/0x250
[ 42.315891] entry_SYSCALL_64_fastpath+0x23/0xc2
[ 42.315924] RIP: 0033:0x7f3af5b0e8e7
[ 42.315949] RSP: 002b:00007fffe6ce0148 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 42.315996] RAX: ffffffffffffffda RBX: 000055be676401e0 RCX: 00007f3af5b0e8e7
[ 42.316951] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055be67640248
[ 42.317887] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
[ 42.318845] R10: 0000000000000883 R11: 0000000000000206 R12: 00007fffe6cdf130
[ 42.319755] R13: 0000000000000000 R14: 0000000000000000 R15: 000055be676401e0
[ 42.320606] Code: c0 74 1c f0 ff 4f 1c 74 02 5d c3 85 f6 74 07 e8 0f d8 ff ff 5d c3 31 f6 e8 c6 fb ff ff 5d c3 48 c7 c6 c8 0f c5 ba e8 58 be 02 00 <0f> 0b 66 0f 1f 44 00 00 66 66 66 66 90 48 85 ff 75 01 c3 55 48
[ 42.323462] RIP: __free_pages+0x38/0x40 RSP: ffffbfefc163be98
[ 42.325735] ---[ end trace 872e008e33f81508 ]---
To solve the bug, we eliminate the dual purpose of balloon.page.
Fixes: f220a80f0c ("VMware balloon: add batching to the vmw_balloon.")
Cc: stable@vger.kernel.org
Reported-by: Oleksandr Natalenko <onatalen@redhat.com>
Signed-off-by: Gil Kupfer <gilkup@gmail.com>
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Xavier Deguillard <xdeguillard@vmware.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2018-06-16 09:52:34 +02:00 |
| .. |
|
altera-stapl
|
|
|
|
c2port
|
drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
|
2017-06-24 07:11:16 +02:00 |
|
cb710
|
|
|
|
cxl
|
cxl: Unlock on error in probe
|
2018-04-13 19:48:22 +02:00 |
|
echo
|
|
|
|
eeprom
|
eeprom: at24: change nvmem stride to 1
|
2017-12-20 10:07:17 +01:00 |
|
genwqe
|
GenWQE: Fix bad page access during abort of resource allocation
|
2016-10-28 08:25:18 -04:00 |
|
ibmasm
|
fs: Replace CURRENT_TIME with current_time() for inode timestamps
|
2016-09-27 21:06:21 -04:00 |
|
lis3lv02d
|
|
|
|
mei
|
mei: remove dev_err message on an unsupported ioctl
|
2018-04-08 12:12:57 +02:00 |
|
mic
|
misc: mic: double free on ioctl error path
|
2017-06-24 07:11:16 +02:00 |
|
sgi-gru
|
drivers/misc/sgi-gru/grumain.c: remove bogus 0x prefix from printk
|
2016-10-27 18:43:43 -07:00 |
|
sgi-xp
|
|
|
|
ti-st
|
|
|
|
vmw_vmci
|
drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
|
2018-04-13 19:47:53 +02:00 |
|
ad525x_dpot-i2c.c
|
|
|
|
ad525x_dpot-spi.c
|
|
|
|
ad525x_dpot.c
|
|
|
|
ad525x_dpot.h
|
|
|
|
apds990x.c
|
|
|
|
apds9802als.c
|
|
|
|
arm-charlcd.c
|
|
|
|
atmel-ssc.c
|
|
|
|
atmel_tclib.c
|
|
|
|
bh1770glc.c
|
|
|
|
cs5535-mfgpt.c
|
|
|
|
ds1682.c
|
|
|
|
dummy-irq.c
|
|
|
|
enclosure.c
|
scsi: ses: don't get power status of SES device slot on probe
|
2018-03-22 09:17:48 +01:00 |
|
fsa9480.c
|
|
|
|
hmc6352.c
|
|
|
|
hpilo.c
|
drivers/misc/hpilo: Changes to support new security states in iLO5 FW
|
2016-09-27 12:53:46 +02:00 |
|
hpilo.h
|
|
|
|
ics932s401.c
|
|
|
|
ioc4.c
|
|
|
|
isl29003.c
|
|
|
|
isl29020.c
|
|
|
|
Kconfig
|
Merge 4.8-rc5 into char-misc-next
|
2016-09-05 08:04:07 +02:00 |
|
kgdbts.c
|
|
|
|
lattice-ecp3-config.c
|
|
|
|
lkdtm.h
|
|
|
|
lkdtm_bugs.c
|
|
|
|
lkdtm_core.c
|
lkdtm: Fix Oops when unloading the module
|
2017-10-08 10:26:07 +02:00 |
|
lkdtm_heap.c
|
|
|
|
lkdtm_perms.c
|
|
|
|
lkdtm_rodata.c
|
lkdtm: Mark lkdtm_rodata_do_nothing() notrace
|
2016-08-31 13:12:38 +02:00 |
|
lkdtm_usercopy.c
|
lkdtm: adjust usercopy tests to bypass const checks
|
2016-09-06 12:17:30 -07:00 |
|
Makefile
|
lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
|
2018-03-22 09:17:49 +01:00 |
|
panel.c
|
misc: panel: properly restore atomic counter on error path
|
2017-11-18 11:22:25 +01:00 |
|
pch_phub.c
|
misc: pch_phub: Add UART_CLK quirk for Boston platform
|
2016-08-31 15:45:18 +02:00 |
|
phantom.c
|
|
|
|
pti.c
|
|
|
|
qcom-coincell.c
|
|
|
|
spear13xx_pcie_gadget.c
|
|
|
|
sram.c
|
|
|
|
ti_dac7512.c
|
|
|
|
tifm_7xx1.c
|
|
|
|
tifm_core.c
|
|
|
|
tsl2550.c
|
|
|
|
vexpress-syscfg.c
|
|
|
|
vmw_balloon.c
|
vmw_balloon: fixing double free when batching mode is off
|
2018-06-16 09:52:34 +02:00 |