From patchwork Mon Apr 4 18:21:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Oliver Upton X-Patchwork-Id: 12800596 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7DF12C433EF for ; Mon, 4 Apr 2022 18:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Mime-Version: Message-Id:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=CD12TDhTDRCYHhqWrViQyOVitTfkmEWwavZ0yTWloLM=; b=j+X XqgLp7dLD6QO/nM7KAK9tUBgiaLahkp0szAp3RTi2fQJj9ulF14FpChnxN4M4kF7737qUZu1PU1pV QJ/NK9ZFcgGxf53j7buIfQeTyZEg2kuDJtjJDV7PO43DEOAxhgepMfdjtvSFlL9T7zbRCwijfSuDB ACXZKDdvOgF2YzVUtNjjcuTr6uJIs17inCBr6HwC3C2Nmtbuu2BfFKpXb46YrePCLvTaheHVGS1Hs 1UhDs0m3/bCwI14CuWWIBqD2hNABdZnhkfWKgshWR95/n28LxZdlSnZAJN94YRRaipNrT1g06HwBd qXRpow4jt7MzP4ebWDl73/qmJ6jR8AQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nbRKW-00G7BT-PL; Mon, 04 Apr 2022 18:21:32 +0000 Received: from mail-io1-xd4a.google.com ([2607:f8b0:4864:20::d4a]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nbRKT-00G7AC-S4 for linux-arm-kernel@lists.infradead.org; Mon, 04 Apr 2022 18:21:31 +0000 Received: by mail-io1-xd4a.google.com with SMTP id y3-20020a056602178300b00645d25c30c1so6841056iox.6 for ; Mon, 04 Apr 2022 11:21:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=VQaIdErXUgdjfuVxv831Q/UJ1CWc5wWY7lxH3zvCVtXh16fjW923ZCg+YZuUsWju3h 4ILe42584P0T1xmue23EdXWW7PxQVhSS77wXAmPxATMxy/cGsyGIM6bUkch6ZVyRElCQ rYfBdRc5h8GB9QfjxeOjmesVjpoFyeeH8Zu3wSnbSfQxQ3f/BrQJ4KI3CO5dBC0PNy47 Yq8oCV8PCHMfzHfZRdiUAWzfhsKGQ1Hpzi816xxYXKutJYAFxMS/T/Z1CZFLs+IWzaVH muqotKois0KT0BZ6aZswP/2F+KHpolFWLj99t2uLkL2he7pDHDC+m/o+W1S/4MwTh6cX aMtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=tqaAKdP2eE7fpTimjQszsvSxbd3yR2BaOyVq4PfECL0tC5msHWPCDEg7m50DmjKHm/ E551Q87TnYhBNaLhfitrQM7+QhmYN9NpFXGSdGUn5h9Jw2eh/a9ONJoF85+XPR6aGK+w rZ0dSjRCNWQx7ZTbA5ymbdQ/sGrbQ9DjwXR5E1SgnXLKYYu3ne4lZDFd7Vg/V+VzgFGp LzeLmsQsBUcKXfwa0z6MipCCztwI/MAnrptfVwSybPjwqlXLKL3Okfa2KbtgUAszU7CU R3uN6UfKtw5Zi91L3zWqeRgyMo+R99QH/BuIeN0CXdbUJmNtFVGlZqiffojVarFBtpd7 t45g== X-Gm-Message-State: AOAM532T3Ztju86+PiCJqddKz+j9GVhK6JyWWTA08Q3Db667r5LheieI a+myYz+rpFAKThMz1gDnLHdIV9xIwhE= X-Google-Smtp-Source: ABdhPJwvPmo526HelrAxxb/UEnfhShlEth+Y810soIVt6pAr1nUtlqyUQGi/Lx6WU18UFIH94tuineOFKlE= X-Received: from oupton.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:404]) (user=oupton job=sendgmr) by 2002:a6b:e40a:0:b0:64c:8ce1:3757 with SMTP id u10-20020a6be40a000000b0064c8ce13757mr727788iog.106.1649096487896; Mon, 04 Apr 2022 11:21:27 -0700 (PDT) Date: Mon, 4 Apr 2022 18:21:16 +0000 Message-Id: <20220404182119.3561025-1-oupton@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1094.g7c7d902a7c-goog Subject: [PATCH v2 0/3] KVM: Fix use-after-free in debugfs From: Oliver Upton To: kvmarm@lists.cs.columbia.edu Cc: kvm@vger.kernel.org, Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , linux-arm-kernel@lists.infradead.org, Peter Shier , Ricardo Koller , Reiji Watanabe , Paolo Bonzini , Sean Christopherson , Oliver Upton X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220404_112129_961530_BD49A95F X-CRM114-Status: GOOD ( 14.63 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Funny enough, dirty_log_perf_test on arm64 highlights some issues around the use of debugfs in KVM. The test leaks a GIC FD across test iterations, and as such the associated VM is never destroyed. Nonetheless, the VM FD is reused for the next VM, which collides with the old debugfs directory. Where things get off is when the vgic-state debugfs file is created. KVM does not check if the VM directory exists before creating the file, which results in the file being added to the root of debugfs when the aforementioned collision occurs. Since KVM relies on deleting the VM directory to clean up all associated files, the errant vgic-state file never gets cleaned up. Poking the file after the VM is destroyed is a use-after-free :) Patch 1 shuts the door on any mistaken debugfs file creations by initializing kvm->debugfs_dentry with ERR_PTR() instead of NULL. The last two patches ensure the GIC FD actually gets closed by the selftests that use it. Patch 2 is a genuine bug fix since it will create multiple VMs for a single test run. The arch_timer test also happens to leak the GIC FD, though it is benign since the test creates a single VM. Patch 3 gets the arch_timer test to follow the well-behaved pattern. Applies cleanly to the second KVM pull (tagged kvm-5.18-2), at commit: c15e0ae42c8e ("KVM: x86: fix sending PV IPI") Tested on an Ampere Altra system in the following combinations: - Bad kernel + fixed selftests - Fixed kernel + bad selftests In both cases there was no vgic-state file at the root of debugfs. v1: https://lore.kernel.org/kvm/20220402174044.2263418-1-oupton@google.com/ v1 -> v2: - Initialize kvm->debugfs_dentry to ERR_PTR(-ENOENT) to prevent the creation of all VM debug files, not just vgic-state. - Leave logging as-is for now. Consider dropping altogether in a later patch (Sean) - Collect R-b from Jing Oliver Upton (3): KVM: Don't create VM debugfs files outside of the VM directory selftests: KVM: Don't leak GIC FD across dirty log test iterations selftests: KVM: Free the GIC FD when cleaning up in arch_timer .../selftests/kvm/aarch64/arch_timer.c | 15 +++++--- .../selftests/kvm/dirty_log_perf_test.c | 34 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 ++++-- 3 files changed, 50 insertions(+), 9 deletions(-)