Commit 5c1f50ab authored by Dan Carpenter's avatar Dan Carpenter Committed by Sean Christopherson
Browse files

KVM: Fix a goof where kvm_create_vm() returns 0 instead of -ENOMEM 



The error path for OOM when allocating buses used to return -ENOMEM using
the local variable 'r', where 'r' was initialized at the top of the
function.  But a new "r = kvm_init_irq_routing(kvm);" was introduced in
the middle of the function, so now the error code is not set and it
eventually leads to a NULL dereference due to kvm_dev_ioctl_create_vm()
thinking kvm_create_vm() succeeded.  Set the error code back to -ENOMEM.

Opportunistically tweak the logic to pre-set "r = -ENOMEM" immediately
before the flows that can fail due to memory allocation failure to make
it less likely that the bug recurs in the future.

Fixes: fbe4a7e8 ("KVM: Setup empty IRQ routing when creating a VM")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/02051e0a-09d8-49a2-917f-7c2f278a1ba1@moroto.mountain


[sean: tweak all of the "r = -ENOMEM" sites, massage changelog]
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent 3dee3b18

virt/kvm/kvm_main.c

+3 −2
Original line number Diff line number Diff line
@@ -1143,8 +1143,7 @@ static struct kvm *kvm_create_vm(unsigned long type, const char *fdname) 
{

	struct kvm *kvm = kvm_arch_alloc_vm();

	struct kvm_memslots *slots;

	int r = -ENOMEM;

	int i, j;

	int r, i, j;



	if (!kvm)

		return ERR_PTR(-ENOMEM);
@@ -1181,6 +1180,7 @@ static struct kvm *kvm_create_vm(unsigned long type, const char *fdname) 
	snprintf(kvm->stats_id, sizeof(kvm->stats_id), "kvm-%d",

		 task_pid_nr(current));



	r = -ENOMEM;

	if (init_srcu_struct(&kvm->srcu))

		goto out_err_no_srcu;

	if (init_srcu_struct(&kvm->irq_srcu))
@@ -1209,6 +1209,7 @@ static struct kvm *kvm_create_vm(unsigned long type, const char *fdname) 
		rcu_assign_pointer(kvm->memslots[i], &kvm->__memslots[i][0]);

	}



	r = -ENOMEM;

	for (i = 0; i < KVM_NR_BUSES; i++) {

		rcu_assign_pointer(kvm->buses[i],

			kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL_ACCOUNT));