[0/3] KVM: kvm_create_vm() bug fixes and cleanup

Message ID	20220816053937.2477106-1-seanjc@google.com (mailing list archive)
Headers	show Return-Path: <kvm-owner@kernel.org> Reply-To: Sean Christopherson <seanjc@google.com> Date: Tue, 16 Aug 2022 05:39:34 +0000 Message-Id: <20220816053937.2477106-1-seanjc@google.com> Mime-Version: 1.0 Subject: [PATCH 0/3] KVM: kvm_create_vm() bug fixes and cleanup From: Sean Christopherson <seanjc@google.com> To: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+744e173caec2e1627ee0@syzkaller.appspotmail.com, Oliver Upton <oliver.upton@linux.dev>, Sean Christopherson <seanjc@google.com>, David Matlack <dmatlack@google.com> Content-Type: text/plain; charset="UTF-8" Precedence: bulk
Series	KVM: kvm_create_vm() bug fixes and cleanup \| expand [0/3] KVM: kvm_create_vm() bug fixes and cleanup [1/3] KVM: Properly unwind VM creation if creating debugfs fails [2/3] KVM: Unconditionally get a ref to /dev/kvm module when creating a VM [3/3] KVM: Move coalesced MMIO initialization (back) into kvm_create_vm()

Message ID

20220816053937.2477106-1-seanjc@google.com (mailing list archive)

Headers

Reply-To: Sean Christopherson <seanjc@google.com>
Date: Tue, 16 Aug 2022 05:39:34 +0000
Message-Id: <20220816053937.2477106-1-seanjc@google.com>
Mime-Version: 1.0
Subject: [PATCH 0/3] KVM: kvm_create_vm() bug fixes and cleanup
From: Sean Christopherson <seanjc@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        syzbot+744e173caec2e1627ee0@syzkaller.appspotmail.com,
        Oliver Upton <oliver.upton@linux.dev>,
        Sean Christopherson <seanjc@google.com>,
        David Matlack <dmatlack@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Series

KVM: kvm_create_vm() bug fixes and cleanup | expand

Message

Sean Christopherson Aug. 16, 2022, 5:39 a.m. UTC

Fix two (embarassing) bugs in kvm_create_vm() where KVM fails to properly
unwind VM creation, which most often manifests as a not-present page fault
due to use-after-free when walking the global vm_list (VM is added and
freed, but never removed from the list).  Patch 3 is a loosely related
clean up.

I discovered the try_get_module() bug by inspection[*].  syzkaller found
the debugfs around the same time.

The try_get_module() bug is especially bad/amusing.  The "rmmod --wait"
behavior KVM is trying to handle was removed ~9 years ago...

[*] https://lore.kernel.org/all/YvU+6fdkHaqQiKxp@google.com

Sean Christopherson (3):
  KVM: Properly unwind VM creation if creating debugfs fails
  KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
  KVM: Move coalesced MMIO initialization (back) into kvm_create_vm()

 virt/kvm/kvm_main.c | 39 +++++++++++++++++----------------------
 1 file changed, 17 insertions(+), 22 deletions(-)


base-commit: 19a7cc817a380f7a412d7d76e145e9e2bc47e52f

[0/3] KVM: kvm_create_vm() bug fixes and cleanup

Message

Comments