From: Sean Christopherson Date: Sat, 11 Feb 2023 01:07:19 +0000 (+0000) Subject: KVM: Protect vcpu->pid dereference via debugfs with RCU X-Git-Tag: v6.6.7~2444^2~6^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=76021e96d781e1fe8de02ebe52f3eb276716b6b0;p=platform%2Fkernel%2Flinux-starfive.git KVM: Protect vcpu->pid dereference via debugfs with RCU Wrap the vcpu->pid dereference in the debugfs hook vcpu_get_pid() with proper RCU read (un)lock. Unlike the code in kvm_vcpu_ioctl(), vcpu_get_pid() is not a simple access; the pid pointer is passed to pid_nr() and fully dereferenced if the pointer is non-NULL. Failure to acquire RCU could result in use-after-free of the old pid if a different task invokes KVM_RUN and puts the last reference to the old vcpu->pid between vcpu_get_pid() reading the pointer and dereferencing it in pid_nr(). Fixes: e36de87d34a7 ("KVM: debugfs: expose pid of vcpu threads") Link: https://lore.kernel.org/r/20230211010719.982919-1-seanjc@google.com Signed-off-by: Sean Christopherson --- diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 479802a..6a658f3 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3870,7 +3870,10 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu) static int vcpu_get_pid(void *data, u64 *val) { struct kvm_vcpu *vcpu = data; - *val = pid_nr(rcu_access_pointer(vcpu->pid)); + + rcu_read_lock(); + *val = pid_nr(rcu_dereference(vcpu->pid)); + rcu_read_unlock(); return 0; }