Re: Broken udelay() on KVM host with a vcpu loaded

Quentin Perret
2026-02-13T14:05:38Z

On Tuesday 10 Feb 2026 at 19:54:36 (+0000), Marc Zyngier wrote:
> On Tue, 10 Feb 2026 15:58:14 +0000,
> Quentin Perret <qperret@google.com> wrote:
> >
> > Ouch, it does seem that the SET_ONE_REG stuff allows to mess with that
> > value _out of vcpu context_, so yeah userspace could change the value
> > while a vcpu thread is preempted in the middle of a udelay loop ...
>
> I don't think so. You can only do that on the vcpu fd, and if the vcpu
> is loaded, it means that you are already holding the vcpu mutex. And
> if you do that from the vcpu thread, then you already have done a
> vcpu_put().

Aha I had missed the locking here -- reasoning about SET_ONE_REG being
issued on a running vCPU was 'interesting' :-).

Reviewed-by: Quentin Perret <qperret@google.com>

And also, I'm only relaying a report that we got from a partner, but we
might want to credit the original reporter:

Reported-by: Hyesoo Yu <hyesoo.yu@samsung.com>

Thanks for the patch!
Quentin