Hi Alex, Paolo,
As reported by Alex [1], since commit 421cfe6596f6 it is possible for
a kvm_put_kvm call to hit a refcount of 0 and trigger kvm_destroy_vm
while the vfio group lock is held. However, if this occurs, and the
associated group is still in the kvm device list, this thread of
execution will attempt to acquire the vfio group lock again, resulting
in a deadlock.
This series proposes to resolve this by adding a new kvm_put_kvm_async
which behaves the same as kvm_put_kvm but, in the case where the refcount
hits 0, will use a workqueue to perform the kvm_destroy_vm asynchronously.
The fix is provided in 2 patches because s390 PCI passthrough has the same
issue, albeit introduced slightly later via a different commit.
[1]: https://lore.kernel.org/kvm/[email protected]/
Matthew Rosato (2):
KVM: async kvm_destroy_vm for vfio devices
KVM: s390: pci: use asyncronous kvm put
arch/s390/kvm/pci.c | 8 ++++++--
drivers/gpu/drm/i915/gvt/kvmgt.c | 6 +++++-
drivers/s390/crypto/vfio_ap_ops.c | 7 ++++++-
include/linux/kvm_host.h | 3 +++
virt/kvm/kvm_main.c | 22 ++++++++++++++++++++++
5 files changed, 42 insertions(+), 4 deletions(-)
--
2.39.0
It's possible that the kvm refcount will reach 0 at this point while the
associated device is still in kvm device list - this would result in a
deadlock on the vfio group lock. Avoid this possibility by using
kvm_put_kvm_async to do the kvm_destroy_vm asynchronously.
Fixes: 09340b2fca00 ("KVM: s390: pci: add routines to start/stop interpretive execution")
Signed-off-by: Matthew Rosato <[email protected]>
---
arch/s390/kvm/pci.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index ec51e810e381..d1d528438138 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -509,7 +509,7 @@ static int kvm_s390_pci_register_kvm(void *opaque, struct kvm *kvm)
kvm_s390_pci_dev_release(zdev);
mutex_unlock(&kvm->lock);
mutex_unlock(&zdev->kzdev_lock);
- kvm_put_kvm(kvm);
+ kvm_put_kvm_async(kvm);
return rc;
}
@@ -567,7 +567,11 @@ static void kvm_s390_pci_unregister_kvm(void *opaque)
mutex_unlock(&kvm->lock);
mutex_unlock(&zdev->kzdev_lock);
- kvm_put_kvm(kvm);
+ /*
+ * Avoid possible deadlock on any currently-held vfio lock by
+ * ensuring the potential kvm_destroy_vm call is done asynchronously
+ */
+ kvm_put_kvm_async(kvm);
}
void kvm_s390_pci_init_list(struct kvm *kvm)
--
2.39.0