[PATCH 0/2] kvm/vfio: fix potential deadlock on vfio group lock

[Matthew Rosato <mjrosato@linux.ibm.com>]

Hi Alex, Paolo,

As reported by Alex [1], since commit 421cfe6596f6 it is possible for
a kvm_put_kvm call to hit a refcount of 0 and trigger kvm_destroy_vm
while the vfio group lock is held.  However, if this occurs, and the
associated group is still in the kvm device list, this thread of
execution will attempt to acquire the vfio group lock again, resulting
in a deadlock.

This series proposes to resolve this by adding a new kvm_put_kvm_async
which behaves the same as kvm_put_kvm but, in the case where the refcount
hits 0, will use a workqueue to perform the kvm_destroy_vm asynchronously.

The fix is provided in 2 patches because s390 PCI passthrough has the same
issue, albeit introduced slightly later via a different commit.

[1]: https://lore.kernel.org/kvm/20230105150930.6ee65182.alex.williamson@redhat.com/

Matthew Rosato (2):
  KVM: async kvm_destroy_vm for vfio devices
  KVM: s390: pci: use asyncronous kvm put

 arch/s390/kvm/pci.c               |  8 ++++++--
 drivers/gpu/drm/i915/gvt/kvmgt.c  |  6 +++++-
 drivers/s390/crypto/vfio_ap_ops.c |  7 ++++++-
 include/linux/kvm_host.h          |  3 +++
 virt/kvm/kvm_main.c               | 22 ++++++++++++++++++++++
 5 files changed, 42 insertions(+), 4 deletions(-)

-- 
2.39.0