[Question Consultation] KVM: x86: No lock protection was applied in handle_ept_misconfig of kernel 5.10?

[Question Consultation] KVM: x86: No lock protection was applied in handle_ept_misconfig of kernel 5.10?

[zoudongjie (A)]

Hi all,

I noticed that in handle_ept_misconfig(), kvm_io_bus_write() is called. And within kvm_io_bus_write(), BUS is obtained
through srcu_dereference(). During this process, kvm->slots_lock is not acquired, nor is srcu_read_lock() called for 
protection. If another process is synchronizing BUS at the same time, synchronize_srcu_expedited() cannot safely reclaim
space(it cannot protect srcu_dereference() outside the critical section?), how can we ensure that BUS obtained by
kvm_io_bus_write() is the latest?

Thanks,
Junjie Cai

Reported by: Junjie Cai <caijunjie15@h-partners.com>

Re: [Question Consultation] KVM: x86: No lock protection was applied in handle_ept_misconfig of kernel 5.10?

[Sean Christopherson]

On Wed, Jul 09, 2025, zoudongjie (A) wrote:
> Hi all,
> 
> I noticed that in handle_ept_misconfig(), kvm_io_bus_write() is called. And
> within kvm_io_bus_write(), BUS is obtained through srcu_dereference(). During
> this process, kvm->slots_lock is not acquired, nor is srcu_read_lock() called
> for protection. 

srcu_read_lock() is called via kvm_vcpu_srcu_read_lock() in the VM-Exit path of
vcpu_enter_guest().  KVM grabs kvm->srcu early during KVM_RUN (again via
kvm_vcpu_srcu_read_lock(), in kvm_arch_vcpu_ioctl_run()), and holds the lock for
essentially the entire duration of KVM_RUN.  SRCU protection is temporarily
dropped only when the vCPU blocks and when the vCPU enters the guest.

> If another process is synchronizing BUS at the same time,
> synchronize_srcu_expedited() cannot safely reclaim space(it cannot protect
> srcu_dereference() outside the critical section?), how can we ensure that BUS
> obtained by kvm_io_bus_write() is the latest?
> 
> Thanks,
> Junjie Cai
> 
> Reported by: Junjie Cai <caijunjie15@h-partners.com>