From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH 1/2] KVM: page track: add a new notifier
 type: track_flush_slot
Date: Wed, 19 Oct 2016 13:56:03 +0200
Message-ID: <f66b030e-490e-8480-ff19-71116f42040a@redhat.com>
References: <c9d63f52-9b6f-5752-2111-773b33adc426@redhat.com>
	<1259cdba-c137-c3da-abe2-ecf51aec6738@linux.intel.com>
	<e992eb4e-0806-8f6e-851d-36eaf389a897@redhat.com>
	<ea9dffe6-7afa-4862-e46f-6f780a309e46@linux.intel.com>
	<523e1446-75f1-fe3a-d818-f7d238d57751@redhat.com>
	<5800B579.9000705@intel.com> <20161014084158.623087aa@t450s.home>
	<20161014084601.2a50ba87@t450s.home> <20161014163545.GA6121@nvidia.com>
	<20161014105124.42b438a6@t450s.home> <20161014221901.GA8865@nvidia.com>
	<20161017100229.1474ae33@t450s.home> <580617BD.8000300@intel.com>
	<20161018085918.61ec0e93@t450s.home> <5806DB2D.6090306@intel.com>
	<2f04a53d-261c-7fb5-6825-117da6a1307d@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: "Tian, Kevin" <kevin.tian@intel.com>,
	Xiao Guangrong <guangrong.xiao@linux.intel.com>,
	kvm@vger.kernel.org, qemu-devel <qemu-devel@nongnu.org>,
	Xiaoguang Chen <xiaoguang.chen@intel.com>,
	Kirti Wankhede <kwankhede@nvidia.com>, Neo Jia <cjia@nvidia.com>
To: Xiao Guangrong <guangrong.xiao@intel.com>, Jike Song <jike.song@intel.com>,
	Alex Williamson <alex.williamson@redhat.com>
Return-path: <qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org>
In-Reply-To: <2f04a53d-261c-7fb5-6825-117da6a1307d@intel.com>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org
Sender: "Qemu-devel" <qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org>
List-Id: kvm.vger.kernel.org



On 19/10/2016 07:45, Xiao Guangrong wrote:
> 
> 
> On 10/19/2016 10:32 AM, Jike Song wrote:
> +EXPORT_SYMBOL_GPL(vfio_group_set_usrdata);
>>>> +
>>>> +void *vfio_group_get_usrdata(struct vfio_group *group)
>>>> +{
>>>> +    return group->usrdata;
>>>> +}
>>>> +EXPORT_SYMBOL_GPL(vfio_group_get_usrdata);
>>>> +
>>>> +void *vfio_group_get_usrdata_by_device(struct device *dev)
>>>> +{
>>>> +    struct vfio_group *vfio_group;
>>>> +
>>>> +    vfio_group = __vfio_group_get_from_iommu(dev->iommu_group);
>>>
>>> We actually need to use iommu_group_get() here.  Kirti adds a
>>> vfio_group_get_from_dev() in v9 03/12 that does this properly.
>>>
>>>> +    if (!vfio_group)
>>>> +        return NULL;
>>>> +
>>>> +    return vfio_group_get_usrdata(vfio_group);
> 
> I am worrying if the kvm instance got from group->usrdata is safe
> enough? What happens if you get the instance after kvm released
> kvm-vfio device?

It shouldn't happen if you use kvm_get_kvm and kvm_put_kvm properly.  It
is almost okay in the patch, just:

> @@ -200,6 +216,8 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
>  
>  		kvm_vfio_update_coherency(dev);
>  
> +		kvm_put_kvm(dev->kvm);
> +
>  		return ret;
>  	}

... please add a new function kvm_vfio_group_clear_kvm(vfio_group) here,
that does vfio_group_set_usrdata(vfio_group, NULL) and kvm_put_kvm.
This should avoid use-after-free.

Paolo