Received: by 2002:a05:6358:5282:b0:b5:90e7:25cb with SMTP id g2csp3292077rwa; Tue, 23 Aug 2022 02:07:29 -0700 (PDT) X-Google-Smtp-Source: AA6agR6TgXK003b8AT6fqLnSPZyjpBG2lYtX080RiLkLUFvvd7Crq4+Xz1oWL7RuJtnpmc9ed/y0 X-Received: by 2002:a17:907:b05:b0:73d:68a6:2c5a with SMTP id h5-20020a1709070b0500b0073d68a62c5amr9064161ejl.245.1661245649588; Tue, 23 Aug 2022 02:07:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1661245649; cv=none; d=google.com; s=arc-20160816; b=oBt24K6Igz7oLZ8ZXNPPYIYTIYo3NtfGpjWFhleMlTm5BjtYezq3sSdGJBjQsnKLQA PvXOS/uaufoGtQxc72hTkrN4uG0p+G4yYxV7vxlJEAlye+32MzXMaxSvc2ZpHByYWkeW cPB4UCGoecGn/xuYG5volifniZMRSV1uMCtu5UTIlC2RHn+2kNYLKJpAtJkEM6JzyxYc Vv7HgfPrD0oY0Juba4dyOXaugzFhvLm9ey8vbpOCANAa+pIw+ZQLvshNj9m+dABlLwFs ZaUi8a57PR4mxzdlF6auYoEaDsg287gRLE/d+eloQy6HPcHlfwpcliy8bNiB/dIEvPtl QiTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=M21N7LoV9QfYb03IKgkBYFy4t44eB9q7FDRrfEULkek=; b=hHS6ENnlNAAnDNu3sJYymIeXGBcXJLxFaqUo91TVChKljBRCX72RY/YLNNcd6Ndcn+ 5boyUbW/CYN7znJEuBEOxmVFByip+lQDDhBLgl4Pcyd3lFTZzZb8cYb9OegTKR4jcZ6W WI6Wc+34r/Yu+/UCMZ7i6bd33IjGzQ46Tb607PhfSOv9ZxkpXWUlPK4SF7FK0X1srWXN GtebJPR5/LNjGtfMSkYG+bW0f0hiOMEn8xONdt61jvRsHM0uKjKKThoQUdQD4rVPfMRg Tr5MlfNz9F/kid2uxPWEmMU2S13HrydDdZN2LcgO7S/W/vOT+YGPxQByIVtVDqYi11j2 7DtQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=RhSGwUiy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h17-20020a056402281100b00446c0ad79ecsi2154182ede.1.2022.08.23.02.07.02; Tue, 23 Aug 2022 02:07:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=RhSGwUiy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241870AbiHWIJq (ORCPT + 99 others); Tue, 23 Aug 2022 04:09:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240165AbiHWIIj (ORCPT ); Tue, 23 Aug 2022 04:08:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86AEF40BC1; Tue, 23 Aug 2022 01:05:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 904A5B81C21; Tue, 23 Aug 2022 08:05:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1665C433C1; Tue, 23 Aug 2022 08:05:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661241927; bh=shzhjZ2bb1Pt+2Da4GAyL7p2ZZ6kUqtw89dmd6HMbLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RhSGwUiyqRYvti5oYzodBkcP8dt4Bs0IoLZQ7LDTembUog4iruA4b46UDmyCFk5gz RDicxyKQXWysbhfgbuYtQ2maMb/myuGw7FmPrluHsP1RvkjJXKm1ZtbrIYURHsw4RM bbpmBgCu0rxYv085MRRBMH+XsxZ01BmFdBJCqfvU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Matlack , Sean Christopherson , Paolo Bonzini Subject: [PATCH 5.19 004/365] KVM: Unconditionally get a ref to /dev/kvm module when creating a VM Date: Tue, 23 Aug 2022 09:58:25 +0200 Message-Id: <20220823080118.329629845@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080118.128342613@linuxfoundation.org> References: <20220823080118.128342613@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sean Christopherson commit 405294f29faee5de8c10cb9d4a90e229c2835279 upstream. Unconditionally get a reference to the /dev/kvm module when creating a VM instead of using try_get_module(), which will fail if the module is in the process of being forcefully unloaded. The error handling when try_get_module() fails doesn't properly unwind all that has been done, e.g. doesn't call kvm_arch_pre_destroy_vm() and doesn't remove the VM from the global list. Not removing VMs from the global list tends to be fatal, e.g. leads to use-after-free explosions. The obvious alternative would be to add proper unwinding, but the justification for using try_get_module(), "rmmod --wait", is completely bogus as support for "rmmod --wait", i.e. delete_module() without O_NONBLOCK, was removed by commit 3f2b9c9cdf38 ("module: remove rmmod --wait option.") nearly a decade ago. It's still possible for try_get_module() to fail due to the module dying (more like being killed), as the module will be tagged MODULE_STATE_GOING by "rmmod --force", i.e. delete_module(..., O_TRUNC), but playing nice with forced unloading is an exercise in futility and gives a falsea sense of security. Using try_get_module() only prevents acquiring _new_ references, it doesn't magically put the references held by other VMs, and forced unloading doesn't wait, i.e. "rmmod --force" on KVM is all but guaranteed to cause spectacular fireworks; the window where KVM will fail try_get_module() is tiny compared to the window where KVM is building and running the VM with an elevated module refcount. Addressing KVM's inability to play nice with "rmmod --force" is firmly out-of-scope. Forcefully unloading any module taints kernel (for obvious reasons) _and_ requires the kernel to be built with CONFIG_MODULE_FORCE_UNLOAD=y, which is off by default and comes with the amusing disclaimer that it's "mainly for kernel developers and desperate users". In other words, KVM is free to scoff at bug reports due to using "rmmod --force" while VMs may be running. Fixes: 5f6de5cbebee ("KVM: Prevent module exit until all VMs are freed") Cc: stable@vger.kernel.org Cc: David Matlack Signed-off-by: Sean Christopherson Message-Id: <20220816053937.2477106-3-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- virt/kvm/kvm_main.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1085,6 +1085,9 @@ static struct kvm *kvm_create_vm(unsigne if (!kvm) return ERR_PTR(-ENOMEM); + /* KVM is pinned via open("/dev/kvm"), the fd passed to this ioctl(). */ + __module_get(kvm_chardev_ops.owner); + KVM_MMU_LOCK_INIT(kvm); mmgrab(current->mm); kvm->mm = current->mm; @@ -1170,16 +1173,6 @@ static struct kvm *kvm_create_vm(unsigne preempt_notifier_inc(); kvm_init_pm_notifier(kvm); - /* - * When the fd passed to this ioctl() is opened it pins the module, - * but try_module_get() also prevents getting a reference if the module - * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait"). - */ - if (!try_module_get(kvm_chardev_ops.owner)) { - r = -ENODEV; - goto out_err; - } - return kvm; out_err: @@ -1201,6 +1194,7 @@ out_err_no_irq_srcu: out_err_no_srcu: kvm_arch_free_vm(kvm); mmdrop(current->mm); + module_put(kvm_chardev_ops.owner); return ERR_PTR(r); }