[PATCH] KVM: Remove the kvm debugfs directory if kvm_init() fails

[Zeng Chi]

From: zengchi <zengchi@xxxxxxxxxx>

kvm_init_debug() creates the "kvm" debugfs directory along with all of
the VM/vCPU stat files, but none of kvm_init()'s error paths removes it.
If kvm_vfio_ops_init(), kvm_gmem_init(), kvm_init_virtualization() or
misc_register() fails, the directory is leaked, and none of kvm_init()'s
callers invokes kvm_exit() on failure, i.e. nothing papers over the
leak.

The stale /sys/kernel/debug/kvm directory isn't just cosmetic: a
subsequent attempt to load KVM makes debugfs_create_dir() fail with
-EEXIST, after which kvm_debugfs_dir holds an ERR_PTR and all stat
files are silently never created again.  Worse, the leaked stat files
reference file_operations and stat data that live in the KVM module; if
the module is unloaded after the failed initialization, reading the
stale files is a use-after-free.

Remove the debugfs directory in the error path, mirroring kvm_exit().

Fixes: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: zengchi <zengchi@xxxxxxxxxx>
---
 virt/kvm/kvm_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 45e784462ec6..8a503ac1adbd 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -6553,6 +6553,7 @@ int kvm_init(unsigned vcpu_size, unsigned vcpu_align, struct module *module)
 err_gmem:
 	kvm_vfio_ops_exit();
 err_vfio:
+	debugfs_remove_recursive(kvm_debugfs_dir);
 	kvm_async_pf_deinit();
 err_async_pf:
 	kvm_irqfd_exit();
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus