Re: [PATCH 23/60] kvm: Move kvm_vcpu sigset members to struct kvm_vcpu_common

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The KVM_SET_SIGNAL_MASK compat ioctl modifies the shared `vcpu->common->sigset` and `sigset_active` without acquiring `kvm_vcpu_mutex(vcpu)`, allowing concurrent modification and permanent signal mask corruption.
--

commit fe2892452671dd3008aaa8107b23e79098e1de7b
Author: Joerg Roedel <joerg.roedel@amd.com>

kvm: Move kvm_vcpu sigset members to struct kvm_vcpu_common

These are the same across all planes for one VCPU, so make then
shared.

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index df4d9952ee5ee..2a446a03b8cce 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
[ ... ]
>  void kvm_sigset_deactivate(struct kvm_vcpu *vcpu)
>  {
> -	if (!vcpu->sigset_active)
> +	struct kvm_vcpu_common *common = vcpu->common;
> +
> +	if (!common->sigset_active)
>  		return;
>  
>  	sigprocmask(SIG_SETMASK, &current->real_blocked, NULL);
[ ... ]
>  static int kvm_vcpu_ioctl_set_sigmask(struct kvm_vcpu *vcpu, sigset_t *sigset)
>  {
> +	struct kvm_vcpu_common *common = vcpu->common;
> +
>  	if (sigset) {
>  		sigdelsetmask(sigset, sigmask(SIGKILL)|sigmask(SIGSTOP));
> -		vcpu->sigset_active = 1;
> -		vcpu->sigset = *sigset;
> +		common->sigset_active = 1;
> +		common->sigset = *sigset;
>  	} else
> -		vcpu->sigset_active = 0;

[Severity: High]
This isn't a bug introduced by this patch, but does moving this state to the
shared common struct expose a race condition across planes?

Looking at kvm_vcpu_compat_ioctl(), it handles KVM_SET_SIGNAL_MASK by
delegating to kvm_vcpu_ioctl_set_sigmask() directly without acquiring the vcpu
mutex.

Since common->sigset_active is now shared across VCPU planes, if one plane is
running KVM_RUN and a userspace process calls the compat ioctl on another
plane's file descriptor, could it locklessly clear common->sigset_active?

If that happens, when the running plane exits and calls
kvm_sigset_deactivate():

void kvm_sigset_deactivate(struct kvm_vcpu *vcpu)
{
        struct kvm_vcpu_common *common = vcpu->common;

        if (!common->sigset_active)
                return;

It would see common->sigset_active as 0 and return early, failing to restore
current->real_blocked.

Could this leave the host thread permanently using the guest's signal mask?

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608144252.351443-1-joro@8bytes.org?part=23