[PATCH v1] virt: acrn: Don't free a VM the hypervisor refused to destroy

[PATCH v1] virt: acrn: Don't free a VM the hypervisor refused to destroy

[Yuho Choi]

acrn_dev_release() calls acrn_vm_destroy() and then frees the VM
whether or not it was destroyed.

Since commit 4c4c1257b844 ("virt: acrn: Do hcall_destroy_vm() before
resource release"), acrn_vm_destroy() returns early when
hcall_destroy_vm() fails, so that the VM can be destroyed again later.
The VM then stays on acrn_vm_list, and its ioreq clients and irqfds
still point to it. That commit names a real-time VM as a case where the
hypervisor refuses, since it can keep running without the Service VM.
The hypervisor also only destroys a paused VM, so the same happens when
the device model exits without pausing the VM.

Once the VM is freed, ioreq_dispatcher() still walks acrn_vm_list on
the next I/O request notification and dereferences the freed VM.

Leak the VM instead when it could not be destroyed.

Fixes: 4c4c1257b844 ("virt: acrn: Do hcall_destroy_vm() before resource release")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Compile-tested only (x86_64 defconfig with ACRN_HSM, W=1); I have no
ACRN setup to test it on.

 drivers/virt/acrn/hsm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
index f170ff4617fdd..8403859e0c868 100644
--- a/drivers/virt/acrn/hsm.c
+++ b/drivers/virt/acrn/hsm.c
@@ -427,8 +427,13 @@ static int acrn_dev_release(struct inode *inode, struct file *filp)
 {
 	struct acrn_vm *vm = filp->private_data;
 
-	acrn_vm_destroy(vm);
-	kfree(vm);
+	/*
+	 * If the hypervisor refused to destroy the VM, it is still on
+	 * acrn_vm_list and its ioreq clients and irqfds still use it, so
+	 * leak it.
+	 */
+	if (!acrn_vm_destroy(vm))
+		kfree(vm);
 	return 0;
 }
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0