Re: Re: [PATCH] libfs: Fix NULL pointer access in simple_recursive_removal

From: rom.wang

Date: Wed Nov 26 2025 - 03:38:29 EST


Yes, thank you, i aggree with your suggest dentry has already beed freed, and i can got the dentry.d_name.name info is "vcpu126" from debug vmcore, and it's parent dentry is "xxxpid_xx" which's d_inode is NULL too., but the parent of "xxxpid_xx" dentry is "kvm" which's d_inode is not NULL. and after checking the source, i guest the root reason is kvm->debugfs_dentry has been freed before freeing vcpu->debugfs_dentry. and the vmcore kernel version is 4.19.

[Patch that introduced the issue]
In commit 3d75b8aa5c2 ("KVM: Always flush async #PF workqueue when vCPU is being destroyed"),
the kvm_get_kvm(work->vcpu->kvm) call was removed from kvm_setup_async_pf,
but the corresponding kvm_put_kvm(work->vcpu->kvm) call was not removed.

[Patch that fixes the issue]
Commit 7863e346e108 ("KVM: async_pf: Cleanup kvm_setup_async_pf()")
will remove the kvm_put_kvm(work->vcpu->kvm) call.

if cherry-pick Commit 7863e346e108 ("KVM: async_pf: Cleanup kvm_setup_async_pf()") to 4.19 brach can fix this issue.