linux-kernel - Re: [PATCH 3/7] KVM: Assert that a destroyed/freed vCPU is no longer visible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z71sOEu7/ewnWZU2@yzhao56-desk.sh.intel.com>
Date: Tue, 25 Feb 2025 15:07:36 +0800
From: Yan Zhao <yan.y.zhao@...el.com>
To: Sean Christopherson <seanjc@...gle.com>
CC: Marc Zyngier <maz@...nel.org>, Oliver Upton <oliver.upton@...ux.dev>,
	Tianrui Zhao <zhaotianrui@...ngson.cn>, Bibo Mao <maobibo@...ngson.cn>,
	Huacai Chen <chenhuacai@...nel.org>, Madhavan Srinivasan
	<maddy@...ux.ibm.com>, Anup Patel <anup@...infault.org>, Paul Walmsley
	<paul.walmsley@...ive.com>, Palmer Dabbelt <palmer@...belt.com>, Albert Ou
	<aou@...s.berkeley.edu>, Christian Borntraeger <borntraeger@...ux.ibm.com>,
	Janosch Frank <frankja@...ux.ibm.com>, Claudio Imbrenda
	<imbrenda@...ux.ibm.com>, Paolo Bonzini <pbonzini@...hat.com>,
	<linux-arm-kernel@...ts.infradead.org>, <kvmarm@...ts.linux.dev>,
	<kvm@...r.kernel.org>, <loongarch@...ts.linux.dev>,
	<linux-mips@...r.kernel.org>, <linuxppc-dev@...ts.ozlabs.org>,
	<kvm-riscv@...ts.infradead.org>, <linux-riscv@...ts.infradead.org>,
	<linux-kernel@...r.kernel.org>, Aaron Lewis <aaronlewis@...gle.com>, "Jim
 Mattson" <jmattson@...gle.com>, Rick P Edgecombe
	<rick.p.edgecombe@...el.com>, Kai Huang <kai.huang@...el.com>, Isaku Yamahata
	<isaku.yamahata@...el.com>
Subject: Re: [PATCH 3/7] KVM: Assert that a destroyed/freed vCPU is no longer
 visible

On Mon, Feb 24, 2025 at 03:55:38PM -0800, Sean Christopherson wrote:
> After freeing a vCPU, assert that it is no longer reachable, and that
> kvm_get_vcpu() doesn't return garbage or a pointer to some other vCPU.
> While KVM obviously shouldn't be attempting to access a freed vCPU, it's
> all too easy for KVM to make a VM-wide request, e.g. via KVM_BUG_ON() or
> kvm_flush_remote_tlbs().
> 
> Alternatively, KVM could short-circuit problematic paths if the VM's
> refcount has gone to zero, e.g. in kvm_make_all_cpus_request(), or KVM
> could try disallow making global requests during teardown.  But given that
> deleting the vCPU from the array Just Works, adding logic to the requests
> path is unnecessary, and trying to make requests illegal during teardown
> would be a fool's errand.
> 
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  virt/kvm/kvm_main.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 201c14ff476f..991e8111e88b 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -489,6 +489,14 @@ void kvm_destroy_vcpus(struct kvm *kvm)
>  	kvm_for_each_vcpu(i, vcpu, kvm) {
>  		kvm_vcpu_destroy(vcpu);
>  		xa_erase(&kvm->vcpu_array, i);
> +
> +		/*
> +		 * Assert that the vCPU isn't visible in any way, to ensure KVM
> +		 * doesn't trigger a use-after-free if destroying vCPUs results
> +		 * in VM-wide request, e.g. to flush remote TLBs when tearing
> +		 * down MMUs, or to mark the VM dead if a KVM_BUG_ON() fires.
> +		 */
> +		WARN_ON_ONCE(xa_load(&kvm->vcpu_array, i) || kvm_get_vcpu(kvm, i));
As xa_erase() says "After this function returns, loading from @index will return
%NULL", is this checking of xa_load() necessary?

>  	}
>  
>  	atomic_set(&kvm->online_vcpus, 0);
> -- 
> 2.48.1.658.g4767266eb4-goog
>