Re: [PATCH v7 04/16] KVM/vfio: Use file-based reference counting for KVM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] vfio: premature KVM reference release on failed cdev bind
--

commit 3b919032adda2d9cc906ebc24555fad4223ad7c1
Author: Steffen Eiden <seiden@linux.ibm.com>

KVM/vfio: Use file-based reference counting for KVM
    
Replace manual module reference counting with file-based reference
counting for KVM integration. Pass struct file pointers instead of
struct kvm pointers throughout the VFIO-KVM interface, leveraging the
kernel's existing file reference counting.

> diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
> index 423ead48aafe3..ed96acfa86358 100644
> --- a/drivers/vfio/vfio_main.c
> +++ b/drivers/vfio/vfio_main.c
> @@ -511,14 +489,7 @@ void vfio_device_put_kvm(struct vfio_device *device)
>  	if (!device->kvm)
>  		return;
>  
> -	if (WARN_ON(!device->put_kvm))
> -		goto clear;
> -
> -	device->put_kvm(device->kvm);
> -	device->put_kvm = NULL;
> -	symbol_put(kvm_put_kvm);
> -
> -clear:
> +	fput(device->kvm);
>  	device->kvm = NULL;
>  }
>  #endif

[Severity: High]
Does this code introduce a regression where the globally shared
device->kvm reference is prematurely released on a failed cdev bind?

Looking at drivers/vfio/device_cdev.c:vfio_df_ioctl_bind_iommufd(), if a
secondary cdev open attempts to bind, it can fail because
device->open_count != 0:

	vfio_df_open(df);
	if (ret)
		goto out_put_kvm;
...
out_put_kvm:
	vfio_device_put_kvm(device);

Unlike the group path which checks if device->open_count == 0, this cdev
error path unconditionally drops the device->kvm reference via
vfio_device_put_kvm(device). This drops the reference belonging to the
primary opener and clears the pointer to NULL.

When the primary opener eventually accesses KVM (or when it closes the
device), the driver skips unregistering the device from KVM, or relies
on a raw pointer (e.g., matrix_mdev->kvm) to a KVM VM that may have
already been freed. Can this regression result in a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008055955.4014342-1-aneesh.kumar@kernel.org?part=4