linux-kernel - Re: [Question Consultation] KVM: x86: No lock protection was applied in handle_ept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aG5jqVJ0S2nDFMch@google.com>
Date: Wed, 9 Jul 2025 05:42:17 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: "zoudongjie (A)" <zoudongjie@...wei.com>
Cc: "pbonzini@...hat.com" <pbonzini@...hat.com>, "tglx@...utronix.de" <tglx@...utronix.de>, 
	"mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>, 
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "x86@...nel.org" <x86@...nel.org>, 
	"hpa@...or.com" <hpa@...or.com>, "kvm@...r.kernel.org" <kvm@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Chenzhendong (alex)" <alex.chen@...wei.com>, 
	luolongmin <luolongmin@...wei.com>, "Mujinsheng (DxJanesir)" <mujinsheng@...wei.com>, 
	"chenjianfei (D)" <chenjianfei3@...wei.com>, "Fangyi (Eric)" <eric.fangyi@...wei.com>, 
	"lishan (E)" <lishan24@...wei.com>, Renxuming <renxuming@...wei.com>, 
	suxiaodong <suxiaodong1@...wei.com>, "caijunjie (A)" <caijunjie15@...artners.com>
Subject: Re: [Question Consultation] KVM: x86: No lock protection was applied
 in handle_ept_misconfig of kernel 5.10?

On Wed, Jul 09, 2025, zoudongjie (A) wrote:
> Hi all,
> 
> I noticed that in handle_ept_misconfig(), kvm_io_bus_write() is called. And
> within kvm_io_bus_write(), BUS is obtained through srcu_dereference(). During
> this process, kvm->slots_lock is not acquired, nor is srcu_read_lock() called
> for protection. 

srcu_read_lock() is called via kvm_vcpu_srcu_read_lock() in the VM-Exit path of
vcpu_enter_guest().  KVM grabs kvm->srcu early during KVM_RUN (again via
kvm_vcpu_srcu_read_lock(), in kvm_arch_vcpu_ioctl_run()), and holds the lock for
essentially the entire duration of KVM_RUN.  SRCU protection is temporarily
dropped only when the vCPU blocks and when the vCPU enters the guest.

> If another process is synchronizing BUS at the same time,
> synchronize_srcu_expedited() cannot safely reclaim space(it cannot protect
> srcu_dereference() outside the critical section?), how can we ensure that BUS
> obtained by kvm_io_bus_write() is the latest?
> 
> Thanks,
> Junjie Cai
> 
> Reported by: Junjie Cai <caijunjie15@...artners.com>