[PATCH] KVM: Protect vcpu->pid dereference via debugfs with RCU

[PATCH] KVM: Protect vcpu->pid dereference via debugfs with RCU

[Sean Christopherson]

Wrap the vcpu->pid dereference in the debugfs hook vcpu_get_pid() with
proper RCU read (un)lock.  Unlike the code in kvm_vcpu_ioctl(),
vcpu_get_pid() is not a simple access; the pid pointer is passed to
pid_nr() and fully dereferenced if the pointer is non-NULL.

Failure to acquire RCU could result in use-after-free of the old pid if
a different task invokes KVM_RUN and puts the last reference to the old
vcpu->pid between vcpu_get_pid() reading the pointer and dereferencing it
in pid_nr().

Fixes: e36de87d34a7 ("KVM: debugfs: expose pid of vcpu threads")
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 virt/kvm/kvm_main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index d255964ec331..b7b72c8fb492 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3867,7 +3867,10 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu)
 static int vcpu_get_pid(void *data, u64 *val)
 {
 	struct kvm_vcpu *vcpu = (struct kvm_vcpu *) data;
-	*val = pid_nr(rcu_access_pointer(vcpu->pid));
+
+	rcu_read_lock();
+	*val = pid_nr(rcu_dereference(vcpu->pid));
+	rcu_read_unlock();
 	return 0;
 }
 

base-commit: 7cb79f433e75b05d1635aefaa851cfcd1cb7dc4f
-- 
2.39.1.581.gbfd45094c4-goog

Re: [PATCH] KVM: Protect vcpu->pid dereference via debugfs with RCU

[Sean Christopherson]

On Sat, 11 Feb 2023 01:07:19 +0000, Sean Christopherson wrote:
> Wrap the vcpu->pid dereference in the debugfs hook vcpu_get_pid() with
> proper RCU read (un)lock.  Unlike the code in kvm_vcpu_ioctl(),
> vcpu_get_pid() is not a simple access; the pid pointer is passed to
> pid_nr() and fully dereferenced if the pointer is non-NULL.
> 
> Failure to acquire RCU could result in use-after-free of the old pid if
> a different task invokes KVM_RUN and puts the last reference to the old
> vcpu->pid between vcpu_get_pid() reading the pointer and dereferencing it
> in pid_nr().
> 
> [...]

Applied to kvm-x86 generic, thanks!

[1/1] KVM: Protect vcpu->pid dereference via debugfs with RCU
      https://github.com/kvm-x86/linux/commit/76021e96d781

--
https://github.com/kvm-x86/linux/tree/next
https://github.com/kvm-x86/linux/tree/fixes