Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 18 Jul 2023 13:00:29 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc:     Paolo Bonzini <pbonzini@redhat.com>,
        Greg KH <gregkh@linuxfoundation.org>,
        Sean Christopherson <seanjc@google.com>,
        Roxana Bradescu <roxabee@google.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] kvm/vfio: ensure kvg instance stays around in
 kvm_vfio_group_add()
Message-ID: <ZLa3HcDnLyiQNXVf@nvidia.com>
References: <ZKyEL/4pFicxMQvg@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ZKyEL/4pFicxMQvg@google.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?eDqUcSdw7CTn5hMtnvTA9jXE3hYWVesiIMJv6srkejknieaA9ybe1bPwWdRq?=
 =?us-ascii?Q?JHSCGhcipS6taA7ux0PgFGvFl51jSnr1OC+n2kUhpgrlR1IR15UaPkeEHVax?=
 =?us-ascii?Q?njKBc7oMm+w2G1zi0oCiGFURBA47DeYL0gPAPTFpeFZjpdUunBmYrqAyW1sS?=
 =?us-ascii?Q?EXGXJMs2lTp64WowJnLDqBeUg5OzlkNLA9I7yySFSLlS0Dvdq+0d4K/jMe/l?=
 =?us-ascii?Q?7At7sEzcvmYbw7IjkGAYfHThupqyChjgzXxABVz7Rwmsn3v//XD0EkpYeg60?=
 =?us-ascii?Q?bZNyer0nDjbKsiIf8re44neZ9iphBsgYO9b/YFQjwIUtJeyJZaJs9giPsu0Y?=
 =?us-ascii?Q?yWVPnrLvFc84gsOl7SiVFzTgtwQ/dbIU2CvcoF+dbGw2hcBooSEQtZxYCVjl?=
 =?us-ascii?Q?+IkGtpg/Wg+gIVNDqOX0LdX+JUYZjc8Eu+5ibjBLYR9vtNRfv2AB5HDW9baJ?=
 =?us-ascii?Q?xqNTAA3eVomJR7142FmGB8y3fe6It6bOCI3fHri34nSLM4Auf66jskWcIxJF?=
 =?us-ascii?Q?7IWmUAqTOpbPCQ1nm/kb2Pcw2NJmq8oZBqjBS6CdqMhnmWSpDOx43h6sAt1t?=
 =?us-ascii?Q?mpR6pgk1TF3i1bag4uF+TXe+1htsPNdVliaQBTnW4Pa+IV1QE8DrDDkMwUv7?=
 =?us-ascii?Q?MsDt1JKJA+5QVI5I1gtQPZ4RNbttxERjIFk17Yj6u6g1YR2QzIbmHq5DTN4V?=
 =?us-ascii?Q?mGH7HAdedCeqSO6AkVR3y5RkNkAaBB7whieUjRWbdrvRPSJZ0xeBx+XJNlUZ?=
 =?us-ascii?Q?cTR8drtDnfaAjU7b1Th404Pryea7Sli8xEB2JWrJ6887PS50fJm8uBW75Vwd?=
 =?us-ascii?Q?Ie7UxCO6tqKppWIH45U6uZfiNermI1xwUWC6IeWclYrmvBSUzIi+ryxjM0G8?=
 =?us-ascii?Q?I4YIPFlkrMs8uQTuTxmDi3EZo589AWRQzBn6SDJ2sOlwRyZlmHo3Vkb2Urhb?=
 =?us-ascii?Q?LYGYp110Ff1aNTfqyTnKHaKnO8mlOPVq2BQsYMpMUbHsmTr6ovLc3qkGr2k3?=
 =?us-ascii?Q?vy5mqECkct+8UQEmcPziAkjm13TzfpEsNNXQJO1FHao8cuc+oQOeQyh5fnUO?=
 =?us-ascii?Q?ydPjhTSOGbzFBwffTSOth7vdd1E+YYKIhdw+Se1xkdo0pP1wEzLaJa/FoSdx?=
 =?us-ascii?Q?t6XOsBdPfGutqpzLR+Nq0qyBWH3XYH3CCIr1EYn4ZCjMMjwZDQYs5I5I0zAo?=
 =?us-ascii?Q?H7VB4QKW0ubteTSHhh6+04VxF+a0cyBJ47BR/QozuPpR84gdmJ1Hu4T+4nzK?=
 =?us-ascii?Q?esMQJnZ8M7b7CTvoBDpRzik1Xk8FI/0aoTWQjQ5aSPwQv0kO3gKayhMuIuPT?=
 =?us-ascii?Q?CnQ/TQQr7s6A6DkVeY6VmwVX82jeeuLRKKM78eBy0fQwmuCm+3J9RHUGWapQ?=
 =?us-ascii?Q?M8r5CM29qx7mKzYSkO0JslAjjowdpZeJePSpy+mtzIUfW8rABlKHeQfZkP+t?=
 =?us-ascii?Q?oVc+v83hjqdRw9hgQuh8Ctt0iWbuON+WM3DPNJTkVjkDJZdb/3W6tLnGjb0N?=
 =?us-ascii?Q?3lt0w7YC/1Nj4d5fmU18zb/ePRkkNtLZrxl7YAtKbok8l4NgVujtz0bZQdt0?=
 =?us-ascii?Q?Hxw1Se2lARTZChqTvqcbME9NM3x+TXd3DYo9bEi+?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2fca4c21-60f6-477b-b7c9-08db87a81cb4
X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jul 2023 16:00:31.1196
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4PRI2fiK+J0a2oyzIrrDxbgNqz+0i1pqA2EpH0zcQHJ03h2GpxxsTbstQ+/pe1Xb
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR12MB7213
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jul 10, 2023 at 03:20:31PM -0700, Dmitry Torokhov wrote:
> kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
> and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
> dropping kv->lock. If we race group addition and deletion calls, kvg
> instance may get freed by the time we get around to calling
> kvm_vfio_file_set_kvm().
> 
> Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
> of kv->lock. We already call it while holding the same lock when vfio
> group is being deleted, so it should be safe here as well.
> 
> Fixes: ba70a89f3c2a ("vfio: Change vfio_group_set_kvm() to vfio_file_set_kvm()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
>  virt/kvm/vfio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

This looks correct, I don't know of any lock cylces that could form
with kv->lock at least

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason