From: Fuad Tabba <tabba@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <seanjc@google.com>,
Shuah Khan <shuah@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>, Oliver Upton <oupton@kernel.org>,
Will Deacon <will@kernel.org>,
Ackerley Tng <ackerleytng@google.com>,
David Matlack <dmatlack@google.com>,
kvm@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] KVM: selftests: Fix FD double-close in kvm_vm_release()
Date: Mon, 11 May 2026 12:37:59 +0100 [thread overview]
Message-ID: <20260511113759.610924-3-tabba@google.com> (raw)
In-Reply-To: <20260511113759.610924-1-tabba@google.com>
kvm_vm_release() closes vmp->fd and vmp->kvm_fd unconditionally, and
kvm_vm_free() calls kvm_vm_release() at teardown. A test that calls
kvm_vm_release() and then kvm_vm_free() without a
vm_recreate_with_one_vcpu() in between double-closes both FDs. Since
kvm_close() asserts on close() failure, the second close trips
TEST_ASSERT and aborts the test, or, if the FD was recycled, silently
closes an unrelated file.
Guard the two closes in kvm_vm_release() by checking each FD against
-1 and resetting it to -1 after closing, matching the existing
kvm_stats_release() idiom. Existing in-tree callers all pass through
vm_recreate_with_one_vcpu() before teardown, so they reassign the FDs
and do not hit the bug today.
Fixes: fa3899add105 ("kvm: selftests: add basic test for state save and restore")
Signed-off-by: Fuad Tabba <tabba@google.com>
---
tools/testing/selftests/kvm/lib/kvm_util.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 2a76eca7029d..e44223714fd4 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -793,8 +793,14 @@ void kvm_vm_release(struct kvm_vm *vmp)
list_for_each_entry_safe(vcpu, tmp, &vmp->vcpus, list)
vm_vcpu_rm(vmp, vcpu);
- kvm_close(vmp->fd);
- kvm_close(vmp->kvm_fd);
+ if (vmp->fd >= 0) {
+ kvm_close(vmp->fd);
+ vmp->fd = -1;
+ }
+ if (vmp->kvm_fd >= 0) {
+ kvm_close(vmp->kvm_fd);
+ vmp->kvm_fd = -1;
+ }
/* Free cached stats metadata and close FD */
kvm_stats_release(&vmp->stats);
--
2.54.0.563.g4f69b47b94-goog
next prev parent reply other threads:[~2026-05-11 11:38 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-11 11:37 [PATCH 0/2] KVM: selftests: Fixes for guest_memfd_test and FD double-close Fuad Tabba
2026-05-11 11:37 ` [PATCH 1/2] KVM: selftests: Fix MADV_COLLAPSE build failure on older toolchains Fuad Tabba
2026-05-11 14:59 ` Sean Christopherson
2026-05-11 11:37 ` Fuad Tabba [this message]
2026-05-11 14:58 ` [PATCH 2/2] KVM: selftests: Fix FD double-close in kvm_vm_release() Sean Christopherson
2026-05-11 15:19 ` Fuad Tabba
2026-05-11 20:25 ` Sean Christopherson
2026-05-12 8:06 ` Fuad Tabba
2026-05-12 13:30 ` Sean Christopherson
2026-05-12 15:04 ` Will Deacon
2026-05-12 15:06 ` Fuad Tabba
2026-05-12 20:24 ` Ackerley Tng
2026-05-13 12:48 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260511113759.610924-3-tabba@google.com \
--to=tabba@google.com \
--cc=ackerleytng@google.com \
--cc=dmatlack@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oupton@kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=shuah@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.