linux-kernel - [Question Consultation] KVM: x86: No lock protection was applied in handle_ept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <fb4c14aa629a4dddb44d0fa9c4f7b498@huawei.com>
Date: Wed, 9 Jul 2025 06:32:10 +0000
From: "zoudongjie (A)" <zoudongjie@...wei.com>
To: "seanjc@...gle.com" <seanjc@...gle.com>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "tglx@...utronix.de" <tglx@...utronix.de>,
	"mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "x86@...nel.org"
	<x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
CC: "Chenzhendong (alex)" <alex.chen@...wei.com>, luolongmin
	<luolongmin@...wei.com>, "Mujinsheng (DxJanesir)" <mujinsheng@...wei.com>,
	"chenjianfei (D)" <chenjianfei3@...wei.com>, "Fangyi (Eric)"
	<eric.fangyi@...wei.com>, "lishan (E)" <lishan24@...wei.com>, Renxuming
	<renxuming@...wei.com>, suxiaodong <suxiaodong1@...wei.com>, "caijunjie (A)"
	<caijunjie15@...artners.com>, "zoudongjie (A)" <zoudongjie@...wei.com>
Subject: [Question Consultation] KVM: x86: No lock protection was applied in
 handle_ept_misconfig of kernel 5.10?

Hi all,

I noticed that in handle_ept_misconfig(), kvm_io_bus_write() is called. And within kvm_io_bus_write(), BUS is obtained
through srcu_dereference(). During this process, kvm->slots_lock is not acquired, nor is srcu_read_lock() called for 
protection. If another process is synchronizing BUS at the same time, synchronize_srcu_expedited() cannot safely reclaim
space(it cannot protect srcu_dereference() outside the critical section?), how can we ensure that BUS obtained by
kvm_io_bus_write() is the latest?

Thanks,
Junjie Cai

Reported by: Junjie Cai <caijunjie15@...artners.com>