Re: [PATCH v3 13/15] KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM: VMX: userspace WARN_ON_ONCE() in vt_vcpu_pi_remove_from_wakeup_list()
--

commit 8f6f619224b282626da2d8fdae4dd65b668b2bef
Author: Sean Christopherson <seanjc@google.com>

KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list

This commit adds vt_vcpu_pi_remove_from_wakeup_list() and calls it from
vmx_vcpu_free() so dying vCPUs that were blocking when the VM was released are
explicitly removed from the Posted Interrupts wakeup list.

> diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
> index 2644add54b76b..7414fb551d2e9 100644
> --- a/arch/x86/kvm/vmx/posted_intr.c
> +++ b/arch/x86/kvm/vmx/posted_intr.c

[ ... ]

> @@ -146,6 +149,19 @@ void vt_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
>  		pi_set_on(pi_desc);
>  }
>  
> +void vt_vcpu_pi_remove_from_wakeup_list(struct kvm_vcpu *vcpu)
> +{
> +	WARN_ON_ONCE(refcount_read(&vcpu->kvm->users_count));

[Severity: High]
Can this WARN_ON_ONCE() be triggered from host userspace if KVM_CREATE_VCPU
fails after kvm_arch_vcpu_create()?

In virt/kvm/kvm_main.c:kvm_vm_ioctl_create_vcpu(), if kvm_dirty_ring_alloc(),
xa_insert(), or create_vcpu_fd() (for example when RLIMIT_NOFILE is reached)
fails, the error path tears down the partially created vCPU while the VM is
still live and vcpu->kvm->users_count is non-zero:

virt/kvm/kvm_main.c:kvm_vm_ioctl_create_vcpu() {
    ...
	r = create_vcpu_fd(vcpu);
	if (r < 0)
		goto kvm_put_xa_erase;
    ...
kvm_put_xa_erase:
	mutex_unlock(&vcpu->mutex);
	kvm_put_kvm_no_destroy(kvm);
	xa_erase(&kvm->vcpu_array, vcpu->vcpu_idx);
unlock_vcpu_destroy:
	vcpu->vcpu_idx = -1;
	kvm_dirty_ring_free(&vcpu->dirty_ring);
arch_vcpu_destroy:
	kvm_arch_vcpu_destroy(vcpu);
}

kvm_arch_vcpu_destroy() calls into vmx_vcpu_free(), which unconditionally
calls vt_vcpu_pi_remove_from_wakeup_list(vcpu). Since the assertion runs
before checking whether the vCPU is actually on the wakeup list (or checking
vcpu->vcpu_idx >= 0), wouldn't a failed KVM_CREATE_VCPU ioctl hit this warning?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027221209.1560865-1-seanjc@google.com?part=13