* [PATCH] KVM: Add missing debugfs cleanup in kvm_init error path
@ 2026-07-09 15:21 Steffen Eiden
2026-07-09 16:52 ` Sean Christopherson
0 siblings, 1 reply; 3+ messages in thread
From: Steffen Eiden @ 2026-07-09 15:21 UTC (permalink / raw)
To: kvm, linux-kernel; +Cc: Paolo Bonzini, Sean Christopherson, Steffen Eiden
If any initialization after kvm_init_debug() fails the cleanup code did
not remove the debugfs entries. Therefore, the corresponding debugfs
entries where still alive but the backing fops are already freed,
creating a use-after-free scenario. Fix this by removing the debugfs
entries if vfio init fails.
Fixes: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
virt/kvm/kvm_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index e44c20c04961..d4420ebfd972 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -6559,6 +6559,7 @@ int kvm_init(unsigned vcpu_size, unsigned vcpu_align, struct module *module)
err_gmem:
kvm_vfio_ops_exit();
err_vfio:
+ debugfs_remove_recursive(kvm_debugfs_dir);
kvm_async_pf_deinit();
err_async_pf:
kvm_irqfd_exit();
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: Add missing debugfs cleanup in kvm_init error path
2026-07-09 15:21 [PATCH] KVM: Add missing debugfs cleanup in kvm_init error path Steffen Eiden
@ 2026-07-09 16:52 ` Sean Christopherson
2026-07-10 8:35 ` Steffen Eiden
0 siblings, 1 reply; 3+ messages in thread
From: Sean Christopherson @ 2026-07-09 16:52 UTC (permalink / raw)
To: Steffen Eiden; +Cc: kvm, linux-kernel, Paolo Bonzini
On Thu, Jul 09, 2026, Steffen Eiden wrote:
> If any initialization after kvm_init_debug() fails the cleanup code did
> not remove the debugfs entries. Therefore, the corresponding debugfs
> entries where still alive but the backing fops are already freed,
> creating a use-after-free scenario. Fix this by removing the debugfs
> entries if vfio init fails.
Already posted, and applied locally on my end.
https://lore.kernel.org/all/20260706095910.39798-1-leixiang%40kylinos.cn
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: Add missing debugfs cleanup in kvm_init error path
2026-07-09 16:52 ` Sean Christopherson
@ 2026-07-10 8:35 ` Steffen Eiden
0 siblings, 0 replies; 3+ messages in thread
From: Steffen Eiden @ 2026-07-10 8:35 UTC (permalink / raw)
To: Sean Christopherson; +Cc: kvm, linux-kernel, Paolo Bonzini
On Thu, Jul 09, 2026 at 09:52:41AM -0700, Sean Christopherson wrote:
> On Thu, Jul 09, 2026, Steffen Eiden wrote:
> > If any initialization after kvm_init_debug() fails the cleanup code did
> > not remove the debugfs entries. Therefore, the corresponding debugfs
> > entries where still alive but the backing fops are already freed,
> > creating a use-after-free scenario. Fix this by removing the debugfs
> > entries if vfio init fails.
>
> Already posted, and applied locally on my end.
>
> https://lore.kernel.org/all/20260706095910.39798-1-leixiang%40kylinos.cn
Oh sorry, I missed that.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-10 8:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 15:21 [PATCH] KVM: Add missing debugfs cleanup in kvm_init error path Steffen Eiden
2026-07-09 16:52 ` Sean Christopherson
2026-07-10 8:35 ` Steffen Eiden
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox