Re: [GIT PULL 4/6] KVM/vfio: Use file-based reference counting for KVM

[Christian Borntraeger <borntraeger@linux.ibm.com>]

Am 09.10.26 um 18:06 schrieb Paolo Bonzini:
> On 10/9/26 16:56, sashiko-bot@kernel.org wrote:
>>> -static void vfio_device_file_set_kvm(struct file *file, struct kvm *kvm)
>>> +static void vfio_device_file_set_kvm(struct file *file, struct file *kvm)
>>>   {
>>>       struct vfio_device_file *df = file->private_data;
>>> +    struct file *old;
>>> +
>>> +    if (kvm)
>>> +        get_file(kvm);
>>
>> [Severity: Critical]
>> Does taking a strong reference to the KVM file here create a circular
>> reference cycle?
>>
>> When userspace adds a VFIO device to a KVM VM, kvm_vfio_file_add() takes a
>> reference to the VFIO file. If vfio_device_file_set_kvm() then takes a
>> reference to the KVM file, both files hold references to each other.
>>
>> Because both file descriptors hold each other's references, their f_count
>> will never reach 0 when userspace closes the FDs, permanently leaking the
>> KVM VM and the VFIO structures.
> 
> False positive, the reference to VFIO is in the KVM-VFIO device file and not in the KVM file descriptor itself.  Using variable names, there is one reference from kvf to vfio and one from vfio to kvm.
> 
> (Right? :))
> 
Yes, already addressed here.

https://lore.kernel.org/kvm/b49ec974-6937-4057-869b-a6e2d5958c6d@linux.ibm.com/