linux-kernel - Re: [PATCH] KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 08 Jun 2020 10:22:45 +0200
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     syzbot+705f4401d5a93a59b87d@...kaller.appspotmail.com,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Subject: Re: [PATCH] KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories

Paolo Bonzini <pbonzini@...hat.com> writes:

> After commit 63d0434 ("KVM: x86: move kvm_create_vcpu_debugfs after
> last failure point") we are creating the pre-vCPU debugfs files
> after the creation of the vCPU file descriptor.  This makes it
> possible for userspace to reach kvm_vcpu_release before
> kvm_create_vcpu_debugfs has finished.  The vcpu->debugfs_dentry
> then does not have any associated inode anymore, and this causes
> a NULL-pointer dereference in debugfs_create_file.
>
> The solution is simply to avoid removing the files; they are
> cleaned up when the VM file descriptor is closed (and that must be
> after KVM_CREATE_VCPU returns).  We can stop storing the dentry
> in struct kvm_vcpu too, because it is not needed anywhere after
> kvm_create_vcpu_debugfs returns.
>
> Reported-by: syzbot+705f4401d5a93a59b87d@...kaller.appspotmail.com
> Fixes: 63d04348371b ("KVM: x86: move kvm_create_vcpu_debugfs after last failure point")
> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> ---
>  arch/arm64/kvm/arm.c     |  5 -----
>  arch/x86/kvm/debugfs.c   | 10 +++++-----
>  include/linux/kvm_host.h |  3 +--
>  virt/kvm/kvm_main.c      |  8 ++++----
>  4 files changed, 10 insertions(+), 16 deletions(-)
>
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index 7a57381c05e8..45276ed50dd6 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -144,11 +144,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
>  	return ret;
>  }
>  
> -int kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
> -{
> -	return 0;
> -}
> -
>  vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf)
>  {
>  	return VM_FAULT_SIGBUS;
> diff --git a/arch/x86/kvm/debugfs.c b/arch/x86/kvm/debugfs.c
> index 018aebce33ff..7e818d64bb4d 100644
> --- a/arch/x86/kvm/debugfs.c
> +++ b/arch/x86/kvm/debugfs.c
> @@ -43,22 +43,22 @@ static int vcpu_get_tsc_scaling_frac_bits(void *data, u64 *val)
>  
>  DEFINE_SIMPLE_ATTRIBUTE(vcpu_tsc_scaling_frac_fops, vcpu_get_tsc_scaling_frac_bits, NULL, "%llu\n");
>  
> -void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
> +void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry)
>  {
> -	debugfs_create_file("tsc-offset", 0444, vcpu->debugfs_dentry, vcpu,
> +	debugfs_create_file("tsc-offset", 0444, debugfs_dentry, vcpu,
>  			    &vcpu_tsc_offset_fops);
>  
>  	if (lapic_in_kernel(vcpu))
>  		debugfs_create_file("lapic_timer_advance_ns", 0444,
> -				    vcpu->debugfs_dentry, vcpu,
> +				    debugfs_dentry, vcpu,
>  				    &vcpu_timer_advance_ns_fops);
>  
>  	if (kvm_has_tsc_control) {
>  		debugfs_create_file("tsc-scaling-ratio", 0444,
> -				    vcpu->debugfs_dentry, vcpu,
> +				    debugfs_dentry, vcpu,
>  				    &vcpu_tsc_scaling_fops);
>  		debugfs_create_file("tsc-scaling-ratio-frac-bits", 0444,
> -				    vcpu->debugfs_dentry, vcpu,
> +				    debugfs_dentry, vcpu,
>  				    &vcpu_tsc_scaling_frac_fops);
>  	}
>  }
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index f43b59b1294c..d38d6b9c24be 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -318,7 +318,6 @@ struct kvm_vcpu {
>  	bool preempted;
>  	bool ready;
>  	struct kvm_vcpu_arch arch;
> -	struct dentry *debugfs_dentry;
>  };
>  
>  static inline int kvm_vcpu_exiting_guest_mode(struct kvm_vcpu *vcpu)
> @@ -888,7 +887,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu);
>  void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu);
>  
>  #ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS
> -void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu);
> +void kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry);
>  #endif
>  
>  int kvm_arch_hardware_enable(void);
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 7fa1e38e1659..3577eb84eac0 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -2973,7 +2973,6 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
>  {
>  	struct kvm_vcpu *vcpu = filp->private_data;
>  
> -	debugfs_remove_recursive(vcpu->debugfs_dentry);
>  	kvm_put_kvm(vcpu->kvm);
>  	return 0;
>  }
> @@ -3000,16 +2999,17 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu)
>  static void kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
>  {
>  #ifdef __KVM_HAVE_ARCH_VCPU_DEBUGFS
> +	struct dentry *debugfs_dentry;
>  	char dir_name[ITOA_MAX_LEN * 2];
>  
>  	if (!debugfs_initialized())
>  		return;
>  
>  	snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id);
> -	vcpu->debugfs_dentry = debugfs_create_dir(dir_name,
> -						  vcpu->kvm->debugfs_dentry);
> +	debugfs_dentry = debugfs_create_dir(dir_name,
> +					    vcpu->kvm->debugfs_dentry);
>  
> -	kvm_arch_create_vcpu_debugfs(vcpu);
> +	kvm_arch_create_vcpu_debugfs(vcpu, debugfs_dentry);
>  #endif
>  }

FWIW,

Reviewed-by: Vitaly Kuznetsov <vkuznets@...hat.com>

Thanks!

-- 
Vitaly