KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup

commit ec5a4919fa7b7d8c7a2af1c7e799b1fe4be84343 upstream.

Unregister KVM's posted interrupt wakeup handler during unsetup so that a
spurious interrupt that arrives after kvm_intel.ko is unloaded doesn't
call into freed memory.

Fixes: bf9f6ac8d749 ("KVM: Update Posted-Interrupts Descriptor when vCPU is blocked")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211009001107.3936588-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 7d595effb66f0819d97e132bb18948231e218e4e..ca2584669862100476a058e4078fd9969ae03ed7 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7551,6 +7551,8 @@ static void vmx_migrate_timers(struct kvm_vcpu *vcpu)
 
 static void hardware_unsetup(void)
 {
+       kvm_set_posted_intr_wakeup_handler(NULL);
+
        if (nested)
                nested_vmx_hardware_unsetup();
 
@@ -7879,8 +7881,6 @@ static __init int hardware_setup(void)
                vmx_x86_ops.request_immediate_exit = __kvm_request_immediate_exit;
        }
 
-       kvm_set_posted_intr_wakeup_handler(pi_wakeup_handler);
-
        kvm_mce_cap_supported |= MCG_LMCE_P;
 
        if (pt_mode != PT_MODE_SYSTEM && pt_mode != PT_MODE_HOST_GUEST)
@@ -7904,6 +7904,9 @@ static __init int hardware_setup(void)
        r = alloc_kvm_area();
        if (r)
                nested_vmx_hardware_unsetup();
+
+       kvm_set_posted_intr_wakeup_handler(pi_wakeup_handler);
+
        return r;
 }