Re: [PATCH] kvm: call kvm_arch_destroy_vm if vm creation fails

[Sean Christopherson <sean.j.christopherson@intel.com>]

On Wed, Oct 23, 2019 at 10:14:35AM -0700, Jim Mattson wrote:
> From: John Sperbeck <jsperbeck@google.com>
> 
> In kvm_create_vm(), if we've successfully called kvm_arch_init_vm(), but
> then fail later in the function, we need to call kvm_arch_destroy_vm()
> so that it can do any necessary cleanup (like freeing memory).
> 
> Fixes: 44a95dae1d229a ("KVM: x86: Detect and Initialize AVIC support")
> Signed-off-by: John Sperbeck <jsperbeck@google.com>
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  virt/kvm/kvm_main.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index fd68fbe0a75d2..10ac7ae03677b 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -645,7 +645,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
>  
>  	r = kvm_arch_init_vm(kvm, type);
>  	if (r)
> -		goto out_err_no_disable;
> +		goto out_err_no_arch_destroy_vm;
>  
>  	r = hardware_enable_all();
>  	if (r)
> @@ -698,10 +698,12 @@ static struct kvm *kvm_create_vm(unsigned long type)
>  	hardware_disable_all();
>  out_err_no_disable:
>  	refcount_set(&kvm->users_count, 0);
> +	kvm_arch_destroy_vm(kvm);

Calling destroy_vm() after zeroing the refcount could lead to a refcount
underrun (and a WARN with CONFIG_REFCOUNT_FULL=y) if an arch were to do
kvm_put_kvm() in destroy_vm() to pair with a kvm_get_kvm() in create_vm().
I doubt any arch actually does that, but it's technically possible since
kvm_arch_create_vm() is called with users_count=1.

If we wanted to be paranoid, a follow-up patch could change refcount_set()
to WARN_ON(!refcount_dec_and_dest()), e.g.:

	kvm_arch_destroy_vm(kvm);
	WARN_ON(!refcount_dec_and_dest(&kvm->users_count));

>  	for (i = 0; i < KVM_NR_BUSES; i++)
>  		kfree(kvm_get_bus(kvm, i));
>  	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
>  		kvm_free_memslots(kvm, __kvm_memslots(kvm, i));
> +out_err_no_arch_destroy_vm:
>  	kvm_arch_free_vm(kvm);
>  	mmdrop(current->mm);
>  	return ERR_PTR(r);
> -- 
> 2.23.0.866.gb869b98d4c-goog
>