Re: [PATCH] KVM: x86: Protect virtualization-enable VM walks with RCU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Data race on `vcpu->arch.tsc_offset_adjustment` during CPU hotplug can lead to guest timekeeping corruption.
--

--- Patch [1]: [PATCH] KVM: x86: Protect virtualization-enable VM walks with RCU ---
commit ff5afc2b0cb8750aad6e3a35f5b08c17dc92aca8
Author: Chengfeng Ye <nicoyip.dev@gmail.com>

KVM: x86: Protect virtualization-enable VM walks with RCU

This commit protects the vm_list walks in kvm_arch_enable_virtualization_cpu()
with RCU. It publishes and removes VMs using RCU list operations to prevent
use-after-free bugs during CPU hotplug concurrent with VM teardown.

Cc: stable@vger.kernel.org

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index afcac1042947a..fb1c14d7dc4b4 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
[ ... ]
> @@ -13192,7 +13193,7 @@ int kvm_arch_enable_virtualization_cpu(void)
>  	 */
>  	if (backwards_tsc) {
>  		u64 delta_cyc = max_tsc - local_tsc;
> -		list_for_each_entry(kvm, &vm_list, vm_list) {
> +		list_for_each_entry_rcu(kvm, &vm_list, vm_list) {
>  			kvm->arch.backwards_tsc_observed = true;
>  			kvm_for_each_vcpu(i, vcpu, kvm) {
>  				vcpu->arch.tsc_offset_adjustment += delta_cyc;

[Severity: High]
This is a pre-existing issue, but can this lockless addition race with a
concurrent kvm_arch_vcpu_load() on a running VM?

During CPU hotplug, the hotplug thread iterates over all vCPUs and modifies
tsc_offset_adjustment here locklessly. Concurrently, if the VM is scheduled
on another active CPU, kvm_arch_vcpu_load() could read and clear
vcpu->arch.tsc_offset_adjustment to 0.

Could this data race result in a lost or corrupted TSC adjustment,
potentially warping the guest's timekeeping?

>  			}
>  		}
>  
>  	}
> +	rcu_read_unlock();
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260804123243.2213854-1-marsy12010123@gmail.com?part=1