Re: [PATCH v3 09/10] KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] False-positive lockdep assertion failure during vCPU creation error path.
--

commit 8e755f55a40a2714aef28c3ce64f3c13f28ac85e
Author: Sean Christopherson <seanjc@google.com>

KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()

This commit adds an assertion to verify that either the vCPU's mutex is held
or the VM is unreachable when using to_hv_vcpu(). It also open-codes accesses
in the Synthetic Timer callbacks to avoid false positives.

[ ... ]

> diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h
> index ea9c81d76dd38..37a0bcf03e281 100644
> --- a/arch/x86/kvm/hyperv.h
> +++ b/arch/x86/kvm/hyperv.h
> @@ -76,6 +76,8 @@ static inline struct kvm_vcpu_hv *to_hv_vcpu_safe(struct kvm_vcpu *vcpu)
>  
>  static inline struct kvm_vcpu_hv *to_hv_vcpu(struct kvm_vcpu *vcpu)
>  {
> +	kvm_lockdep_assert_vcpu_is_locked_or_unreachable(vcpu);

[Severity: High]
Can this assertion trigger a false positive on the vCPU creation error path?

If create_vcpu_fd() fails in kvm_vm_ioctl_create_vcpu() (for example, if an
unprivileged user space process exhausts its file descriptors), the kernel
takes the error path:

virt/kvm/kvm_main.c:kvm_vm_ioctl_create_vcpu() {
    ...
kvm_put_xa_erase:
    mutex_unlock(&vcpu->mutex);
    kvm_put_kvm_no_destroy(kvm);
    xa_erase(&kvm->vcpu_array, vcpu->vcpu_idx);
unlock_vcpu_destroy:
    ...
    kvm_arch_vcpu_destroy(vcpu);
}

Since vcpu->vcpu_idx is not reset to -1 before calling kvm_arch_vcpu_destroy(),
the subsequent call chain of kvm_arch_vcpu_destroy() -> kvm_hv_vcpu_uninit() ->
to_hv_vcpu() will evaluate vcpu->vcpu_idx >= 0.

With the mutex unlocked and users_count > 0, wouldn't this cause the lockdep
assertion to fail, leading to a kernel warning or panic if panic_on_warn is
enabled?

> +
>  	return vcpu->arch.hyperv;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625223623.3376478-1-seanjc@google.com?part=9