linux-kernel - [PATCH] KVM: x86: Reacquire kvm->srcu in vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220224190609.3464071-1-seanjc@google.com>
Date:   Thu, 24 Feb 2022 19:06:09 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Like Xu <like.xu.linux@...il.com>
Subject: [PATCH] KVM: x86: Reacquire kvm->srcu in vcpu_run() if exiting on
 pending signal

Reacquire kvm->srcu in vcpu_run() before returning to the caller if srcu
was dropped to handle pending work.  If the task receives a signal, KVM
will exit without reacquiring kvm->srcu, resulting in an unbalanced
unlock kvm_arch_vcpu_ioctl_run(), and eventually hung tasks.

 =====================================
 WARNING: bad unlock balance detected!
 5.17.0-rc3+ #749 Not tainted
 -------------------------------------
 CPU 0/KVM/1803 is trying to release lock (&kvm->srcu) at:
 [<ffffffff81042a19>] kvm_arch_vcpu_ioctl_run+0x669/0x1f60
 but there are no more locks to release!

 other info that might help us debug this:
 1 lock held by CPU 0/KVM/1803:
  #0: ffff88810489c0b0 (&vcpu->mutex){....}-{3:3}, at: kvm_vcpu_ioctl+0x77/0x690

 stack backtrace:
 CPU: 7 PID: 1803 Comm: CPU 0/KVM Not tainted 5.17.0-rc3+ #749
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x34/0x44
  lock_release+0x1b4/0x240
  kvm_arch_vcpu_ioctl_run+0x680/0x1f60
  kvm_vcpu_ioctl+0x279/0x690
  __x64_sys_ioctl+0x83/0xb0
  do_syscall_64+0x3b/0xc0
  entry_SYSCALL_64_after_hwframe+0x44/0xae
  </TASK>
 INFO: task stable:2347 blocked for more than 120 seconds.
       Not tainted 5.17.0-rc3+ #749
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 task:stable          state:D stack:    0 pid: 2347 ppid:  2340 flags:0x00000000
 Call Trace:
  <TASK>
  __schedule+0x328/0xa00
  schedule+0x44/0xb0
  schedule_timeout+0x26f/0x300
  wait_for_completion+0x84/0xe0
  __synchronize_srcu.part.0+0x7a/0xa0
  kvm_swap_active_memslots+0x141/0x180
  kvm_set_memslot+0x2f9/0x470
  kvm_set_memory_region+0x29/0x40
  kvm_vm_ioctl+0x2c3/0xd70
  __x64_sys_ioctl+0x83/0xb0
  do_syscall_64+0x3b/0xc0
  entry_SYSCALL_64_after_hwframe+0x44/0xae
  </TASK>
 INFO: lockdep is turned off.

Fixes: 5d8d2bfc5e65 ("KVM: x86: pull kvm->srcu read-side to kvm_arch_vcpu_ioctl_run")
Cc: Like Xu <like.xu.linux@...il.com>
Signed-off-by: Sean Christopherson <seanjc@...gle.com>
---
 arch/x86/kvm/x86.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e55de9b48d1a..6de4d810f5b2 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10281,9 +10281,10 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
 		if (__xfer_to_guest_mode_work_pending()) {
 			srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
 			r = xfer_to_guest_mode_handle_work(vcpu);
+			vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
+
 			if (r)
 				return r;
-			vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
 		}
 	}
 

base-commit: 991f988b43c5ee82ef681907bfe979bee93a55c2
-- 
2.35.1.574.g5d30c73bfb-goog