linux-kernel - Re: [PATCH] KVM: allow struct kvm to outlive the file descriptors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yh+trXegvWs+e5l3@google.com>
Date:   Wed, 2 Mar 2022 17:47:25 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        dmatlack@...gle.com
Subject: Re: [PATCH] KVM: allow struct kvm to outlive the file descriptors

On Wed, Mar 02, 2022, Paolo Bonzini wrote:
> Right now, the kvm module is kept alive by VFS via fops_get/fops_put, but there
> may be cases in which a kvm_get_kvm's matching kvm_put_kvm happens after
> the file descriptor is closed.  One case that will be introduced soon is
> when work is delegated to the system work queue; the worker might be
> a bit late and the file descriptor can be closed in the meantime.  Ensure
> that the module has not gone away by tying a module reference explicitly
> to the lifetime of the struct kvm.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> ---
>  virt/kvm/kvm_main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 64eb99444688..e3f37fc2ebf1 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1131,6 +1131,9 @@ static struct kvm *kvm_create_vm(unsigned long type)
>  	preempt_notifier_inc();
>  	kvm_init_pm_notifier(kvm);
>  
> +	/* This is safe, since we have a reference from open(). */
> +	__module_get(THIS_MODULE);

This isn't sufficient.  For x86, it only grabs a reference to kvm.ko, not the
vendor module.  Instead, we can do:

	if (!try_module_get(kvm_chardev_ops.owner))
		return ERR_PTR(-EINVAL);

And then on top, revert commit revert ("KVM: set owner of cpu and vm file operations").
vCPUs file descriptors hold reference to the VM, which means they indirectly hold a
reference to the module. So once the "real" bug of struct kvm not holding a reference
to the module is fixed, grabbing a reference when a VM/vCPU inode is opened becomes
unnecessary.