nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories

Browse source 
After commit 63d0434 ("KVM: x86: move kvm_create_vcpu_debugfs after
last failure point") we are creating the pre-vCPU debugfs files
after the creation of the vCPU file descriptor.  This makes it
possible for userspace to reach kvm_vcpu_release before
kvm_create_vcpu_debugfs has finished.  The vcpu->debugfs_dentry
then does not have any associated inode anymore, and this causes
a NULL-pointer dereference in debugfs_create_file.

The solution is simply to avoid removing the files; they are
cleaned up when the VM file descriptor is closed (and that must be
after KVM_CREATE_VCPU returns).  We can stop storing the dentry
in struct kvm_vcpu too, because it is not needed anywhere after
kvm_create_vcpu_debugfs returns.

Reported-by: syzbot+705f4401d5a93a59b87d@syzkaller.appspotmail.com
Fixes: 63d0434837 ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2020-06-04 15:16:52 +02:00
parent 6929f71e46
commit d56f5136b0
4 changed files with 10 additions and 16 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

5
arch/arm64/kvm/arm.c
View file

@ -144,11 +144,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
return ret; return ret;
} }
int kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
{
return 0;
}
vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf) vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf)
{ {
return VM_FAULT_SIGBUS; return VM_FAULT_SIGBUS;

10
arch/x86/kvm/debugfs.c
View file

@ -43,22 +43,22 @@ static int vcpu_get_tsc_scaling_frac_bits(void *data, u64 *val)
DEFINE_SIMPLE_ATTRIBUTE(vcpu_tsc_scaling_frac_fops, vcpu_get_tsc_scaling_frac_bits, NULL, "%llu\n"); DEFINE_SIMPLE_ATTRIBUTE(vcpu_tsc_scaling_frac_fops, vcpu_get_tsc_scaling_frac_bits, NULL, "%llu\n");
void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu) void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry)
{ {
debugfs_create_file("tsc-offset", 0444, vcpu->debugfs_dentry, vcpu, debugfs_create_file("tsc-offset", 0444, debugfs_dentry, vcpu,
&vcpu_tsc_offset_fops); &vcpu_tsc_offset_fops);
if (lapic_in_kernel(vcpu)) if (lapic_in_kernel(vcpu))
debugfs_create_file("lapic_timer_advance_ns", 0444, debugfs_create_file("lapic_timer_advance_ns", 0444,
vcpu->debugfs_dentry, vcpu, debugfs_dentry, vcpu,
&vcpu_timer_advance_ns_fops); &vcpu_timer_advance_ns_fops);
if (kvm_has_tsc_control) { if (kvm_has_tsc_control) {
debugfs_create_file("tsc-scaling-ratio", 0444, debugfs_create_file("tsc-scaling-ratio", 0444,
vcpu->debugfs_dentry, vcpu, debugfs_dentry, vcpu,
&vcpu_tsc_scaling_fops); &vcpu_tsc_scaling_fops);
debugfs_create_file("tsc-scaling-ratio-frac-bits", 0444, debugfs_create_file("tsc-scaling-ratio-frac-bits", 0444,
vcpu->debugfs_dentry, vcpu, debugfs_dentry, vcpu,
&vcpu_tsc_scaling_frac_fops); &vcpu_tsc_scaling_frac_fops);
} }
} }

3
include/linux/kvm_host.h
View file

@ -318,7 +318,6 @@ struct kvm_vcpu {
bool preempted; bool preempted;
bool ready; bool ready;
struct kvm_vcpu_arch arch; struct kvm_vcpu_arch arch;
struct dentry *debugfs_dentry;
}; };
static inline int kvm_vcpu_exiting_guest_mode(struct kvm_vcpu *vcpu) static inline int kvm_vcpu_exiting_guest_mode(struct kvm_vcpu *vcpu)
@ -888,7 +887,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu);
void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu); void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu);
#ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS #ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS
void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu); void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry);
#endif #endif
int kvm_arch_hardware_enable(void); int kvm_arch_hardware_enable(void);

6
virt/kvm/kvm_main.c
View file

@ -2973,7 +2973,6 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
{ {
struct kvm_vcpu *vcpu = filp->private_data; struct kvm_vcpu *vcpu = filp->private_data;
debugfs_remove_recursive(vcpu->debugfs_dentry);
kvm_put_kvm(vcpu->kvm); kvm_put_kvm(vcpu->kvm);
return 0; return 0;
} }
@ -3000,16 +2999,17 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu)
static void kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu) static void kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
{ {
#ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS #ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS
struct dentry *debugfs_dentry;
char dir_name[ITOA_MAX_LEN * 2]; char dir_name[ITOA_MAX_LEN * 2];
if (!debugfs_initialized()) if (!debugfs_initialized())
return; return;
snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id); snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id);
vcpu->debugfs_dentry = debugfs_create_dir(dir_name, debugfs_dentry = debugfs_create_dir(dir_name,
vcpu->kvm->debugfs_dentry); vcpu->kvm->debugfs_dentry);
kvm_arch_create_vcpu_debugfs(vcpu); kvm_arch_create_vcpu_debugfs(vcpu, debugfs_dentry);
#endif #endif
} }