Commit d56f5136 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories 



After commit 63d04348 ("KVM: x86: move kvm_create_vcpu_debugfs after
last failure point") we are creating the pre-vCPU debugfs files
after the creation of the vCPU file descriptor.  This makes it
possible for userspace to reach kvm_vcpu_release before
kvm_create_vcpu_debugfs has finished.  The vcpu->debugfs_dentry
then does not have any associated inode anymore, and this causes
a NULL-pointer dereference in debugfs_create_file.

The solution is simply to avoid removing the files; they are
cleaned up when the VM file descriptor is closed (and that must be
after KVM_CREATE_VCPU returns).  We can stop storing the dentry
in struct kvm_vcpu too, because it is not needed anywhere after
kvm_create_vcpu_debugfs returns.

Reported-by: default avatar <syzbot+705f4401d5a93a59b87d@syzkaller.appspotmail.com>
Fixes: 63d04348 ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point")
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 6929f71e

arch/arm64/kvm/arm.c

+0 −5
Original line number Diff line number Diff line
@@ -144,11 +144,6 @@ out_fail_alloc: 
	return ret;

}



int kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)

{

	return 0;

}



vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf)

{

	return VM_FAULT_SIGBUS;

arch/x86/kvm/debugfs.c

+5 −5
Original line number Diff line number Diff line
@@ -43,22 +43,22 @@ static int vcpu_get_tsc_scaling_frac_bits(void *data, u64 *val) 


DEFINE_SIMPLE_ATTRIBUTE(vcpu_tsc_scaling_frac_fops, vcpu_get_tsc_scaling_frac_bits, NULL, "%llu\n");



void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)

void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry)

{

	debugfs_create_file("tsc-offset", 0444, vcpu->debugfs_dentry, vcpu,

	debugfs_create_file("tsc-offset", 0444, debugfs_dentry, vcpu,

			    &vcpu_tsc_offset_fops);



	if (lapic_in_kernel(vcpu))

		debugfs_create_file("lapic_timer_advance_ns", 0444,

				    vcpu->debugfs_dentry, vcpu,

				    debugfs_dentry, vcpu,

				    &vcpu_timer_advance_ns_fops);



	if (kvm_has_tsc_control) {

		debugfs_create_file("tsc-scaling-ratio", 0444,

				    vcpu->debugfs_dentry, vcpu,

				    debugfs_dentry, vcpu,

				    &vcpu_tsc_scaling_fops);

		debugfs_create_file("tsc-scaling-ratio-frac-bits", 0444,

				    vcpu->debugfs_dentry, vcpu,

				    debugfs_dentry, vcpu,

				    &vcpu_tsc_scaling_frac_fops);

	}

}

include/linux/kvm_host.h

+1 −2
Original line number Diff line number Diff line
@@ -318,7 +318,6 @@ struct kvm_vcpu { 
	bool preempted;

	bool ready;

	struct kvm_vcpu_arch arch;

	struct dentry *debugfs_dentry;

};



static inline int kvm_vcpu_exiting_guest_mode(struct kvm_vcpu *vcpu)
@@ -888,7 +887,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu); 
void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu);



#ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS

void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu);

void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry);

#endif



int kvm_arch_hardware_enable(void);

virt/kvm/kvm_main.c

+4 −4
Original line number Diff line number Diff line
@@ -2973,7 +2973,6 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp) 
{

	struct kvm_vcpu *vcpu = filp->private_data;



	debugfs_remove_recursive(vcpu->debugfs_dentry);

	kvm_put_kvm(vcpu->kvm);

	return 0;

}
@@ -3000,16 +2999,17 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu) 
static void kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)

{

#ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS

	struct dentry *debugfs_dentry;

	char dir_name[ITOA_MAX_LEN * 2];



	if (!debugfs_initialized())

		return;



	snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id);

	vcpu->debugfs_dentry = debugfs_create_dir(dir_name,

	debugfs_dentry = debugfs_create_dir(dir_name,

					    vcpu->kvm->debugfs_dentry);



	kvm_arch_create_vcpu_debugfs(vcpu);

	kvm_arch_create_vcpu_debugfs(vcpu, debugfs_dentry);

#endif

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE