Re: [PATCH] KVM: Make kvm_io_bus_get_dev() filter devices by ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dropping the SRCU lock in kvm_io_bus_get_dev() exposes a Use-After-Free for VGIC redistributors.
--

commit 954101cd7bbd1642133e68638e5210cf89b88023
Author: Marc Zyngier <maz@kernel.org>

KVM: Make kvm_io_bus_get_dev() filter devices by ops

This commit updates kvm_io_bus_get_dev() to check the device ops pointer
before dropping the SRCU lock. This aims to prevent lifetime issues where
a caller might introspect an object of the wrong type after the lock is
dropped.

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c

[ ... ]

> @@ -6081,7 +6082,9 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
>  	if (dev_idx < 0)
>  		goto out_unlock;
>  
> -	iodev = bus->range[dev_idx].dev;
> +	if (bus->range[dev_idx].dev &&
> +	    bus->range[dev_idx].dev->ops == ops)
> +		iodev = bus->range[dev_idx].dev;
>  
>  out_unlock:
>  	srcu_read_unlock(&kvm->srcu, srcu_idx);

[Severity: High]
This is a pre-existing issue, but does dropping the SRCU lock here before
returning the matched device pointer expose a use-after-free?

If a host VMM concurrently executes KVM_SIGNAL_MSI (with a doorbell address
overlapping the redistributor) and KVM_CREATE_VCPU (forced to fail due to
resource exhaustion), the failed vCPU creation path can unregister the
device and free the vCPU memory.

Because the SRCU lock is already dropped here, the unregister path won't
be blocked. When the MSI injection path resumes in __vgic_doorbell_to_its(),
it can dereference the freed vCPU memory:

arch/arm64/kvm/vgic/vgic-its.c:__vgic_doorbell_to_its() {
    ...
    kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, &kvm_io_gic_ops, db);
    if (!kvm_io_dev)
        return ERR_PTR(-EINVAL);

    iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
    if (iodev->iodev_type != IODEV_ITS)
        return ERR_PTR(-EINVAL);
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626111344.802555-1-maz@kernel.org?part=1