Re: [PATCH 0/6] KVM: Fix bugs in vCPUs xarray usage

[Sean Christopherson]

On Wed, 09 Oct 2024 08:04:49 -0700, Sean Christopherson wrote:
> This series stems from Will's observation[*] that kvm_vm_ioctl_create_vcpu()'s
> handling of xa_store() failure when inserting into vcpu_array is technically
> broken, although in practice it's impossible for xa_store() to fail.
> 
> After much back and forth and staring, I realized that commit afb2acb2e3a3
> ("KVM: Fix vcpu_array[0] races") papered over underlying bugs in
> kvm_get_vcpu() and kvm_for_each_vcpu().  The core problem is that KVM
> allowed other tasks to see vCPU0 while online_vcpus==0, and thus trying
> to gracefully error out of vCPU creation led to use-after-free failures.
> 
> [...]

Applied to kvm-x86 vcpu_array to get coverage in -next, and to force Paolo's
hand :-).

Paolo, I put this in a dedicated branch so that it's easy to toss if you want to
go a different direction for the xarray insertion mess.

[1/6] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
      https://github.com/kvm-x86/linux/commit/1e7381f3617d
[2/6] KVM: Verify there's at least one online vCPU when iterating over all vCPUs
      https://github.com/kvm-x86/linux/commit/0664dc74e9d0
[3/6] KVM: Grab vcpu->mutex across installing the vCPU's fd and bumping online_vcpus
      https://github.com/kvm-x86/linux/commit/6e2b2358b3ef
[4/6] Revert "KVM: Fix vcpu_array[0] races"
      https://github.com/kvm-x86/linux/commit/d0831edcd87e
[5/6] KVM: Don't BUG() the kernel if xa_insert() fails with -EBUSY
      https://github.com/kvm-x86/linux/commit/e53dc37f5a06
[6/6] KVM: Drop hack that "manually" informs lockdep of kvm->lock vs. vcpu->mutex
      https://github.com/kvm-x86/linux/commit/01528db67f28

--
https://github.com/kvm-x86/linux/tree/next