linux-kernel - Re: [v2] KVM: x86: Question on lock protection in handle_ept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABgObfYi2uM9Ek8pPrHXzeuzXd_9p_sL=0WckWnyOmtuJnj_ug@mail.gmail.com>
Date: Wed, 9 Jul 2025 15:01:34 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: "zoudongjie (A)" <zoudongjie@...wei.com>
Cc: Sean Christopherson <seanjc@...gle.com>, Thomas Gleixner <tglx@...utronix.de>, 
	Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, "the arch/x86 maintainers" <x86@...nel.org>, 
	"Anvin, H. Peter" <hpa@...or.com>, kvm <kvm@...r.kernel.org>, 
	"Kernel Mailing List, Linux" <linux-kernel@...r.kernel.org>, "Chenzhendong (alex)" <alex.chen@...wei.com>, 
	luolongmin <luolongmin@...wei.com>, "Mujinsheng (DxJanesir)" <mujinsheng@...wei.com>, 
	"chenjianfei (D)" <chenjianfei3@...wei.com>, "Fangyi (Eric)" <eric.fangyi@...wei.com>, 
	"lishan (E)" <lishan24@...wei.com>, Renxuming <renxuming@...wei.com>, 
	suxiaodong <suxiaodong1@...wei.com>, "caijunjie (A)" <caijunjie15@...artners.com>
Subject: Re: [v2] KVM: x86: Question on lock protection in handle_ept_misconfig

Il mer 9 lug 2025, 08:50 zoudongjie (A) <zoudongjie@...wei.com> ha scritto:
>
> Resending as plain text to fix formatting issues.
> ---
>
> Hi all,
>
> I noticed that in handle_ept_misconfig(), kvm_io_bus_write() is called. And
> within kvm_io_bus_write(), BUS is obtained through srcu_dereference(). During
> this process, kvm->slots_lock is not acquired, nor is srcu_read_lock() called
> for protection.


Hi, srcu_read_lock() is guaranteed by the caller (see vcpu_enter_guest
in arch/x86/kvm/x86.c).

In fact, almost all of KVM_RUN is covered by a SRCU read critical
section, except for:

1) the part where the processor is in guest mode and the nearby
preparations (that's vcpu_enter_guest)

2) when the vCPU goes to a non-runnable state, for example waiting for
an interrupt (search for kvm_vcpu_block and kvm_vcpu_halt)

Thanks,

Paolo

> If another process is synchronizing BUS at the same time,
> synchronize_srcu_expedited() cannot safely reclaim space(it cannot protect
> srcu_dereference() outside the critical section?), how can we ensure that BUS
> obtained by kvm_io_bus_write() is the latest?
>
> Thanks,
> Junjie Cai
>
> Reported by: Junjie Cai <mailto:caijunjie15@...artners.com>
>