From: Fuad Tabba <tabba@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <seanjc@google.com>,
Shuah Khan <shuah@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>, Oliver Upton <oupton@kernel.org>,
Will Deacon <will@kernel.org>,
Ackerley Tng <ackerleytng@google.com>,
David Matlack <dmatlack@google.com>,
kvm@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] KVM: selftests: Fix FD double-close in kvm_vm_release()
Date: Mon, 11 May 2026 12:37:59 +0100 [thread overview]
Message-ID: <20260511113759.610924-3-tabba@google.com> (raw)
In-Reply-To: <20260511113759.610924-1-tabba@google.com>
kvm_vm_release() closes vmp->fd and vmp->kvm_fd unconditionally, and
kvm_vm_free() calls kvm_vm_release() at teardown. A test that calls
kvm_vm_release() and then kvm_vm_free() without a
vm_recreate_with_one_vcpu() in between double-closes both FDs. Since
kvm_close() asserts on close() failure, the second close trips
TEST_ASSERT and aborts the test, or, if the FD was recycled, silently
closes an unrelated file.
Guard the two closes in kvm_vm_release() by checking each FD against
-1 and resetting it to -1 after closing, matching the existing
kvm_stats_release() idiom. Existing in-tree callers all pass through
vm_recreate_with_one_vcpu() before teardown, so they reassign the FDs
and do not hit the bug today.
Fixes: fa3899add105 ("kvm: selftests: add basic test for state save and restore")
Signed-off-by: Fuad Tabba <tabba@google.com>
---
tools/testing/selftests/kvm/lib/kvm_util.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 2a76eca7029d..e44223714fd4 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -793,8 +793,14 @@ void kvm_vm_release(struct kvm_vm *vmp)
list_for_each_entry_safe(vcpu, tmp, &vmp->vcpus, list)
vm_vcpu_rm(vmp, vcpu);
- kvm_close(vmp->fd);
- kvm_close(vmp->kvm_fd);
+ if (vmp->fd >= 0) {
+ kvm_close(vmp->fd);
+ vmp->fd = -1;
+ }
+ if (vmp->kvm_fd >= 0) {
+ kvm_close(vmp->kvm_fd);
+ vmp->kvm_fd = -1;
+ }
/* Free cached stats metadata and close FD */
kvm_stats_release(&vmp->stats);
--
2.54.0.563.g4f69b47b94-goog
next prev parent reply other threads:[~2026-05-11 11:38 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-11 11:37 [PATCH 0/2] KVM: selftests: Fixes for guest_memfd_test and FD double-close Fuad Tabba
2026-05-11 11:37 ` [PATCH 1/2] KVM: selftests: Fix MADV_COLLAPSE build failure on older toolchains Fuad Tabba
2026-05-11 14:59 ` Sean Christopherson
2026-05-11 11:37 ` Fuad Tabba [this message]
2026-05-11 14:58 ` [PATCH 2/2] KVM: selftests: Fix FD double-close in kvm_vm_release() Sean Christopherson
2026-05-11 15:19 ` Fuad Tabba
2026-05-11 20:25 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260511113759.610924-3-tabba@google.com \
--to=tabba@google.com \
--cc=ackerleytng@google.com \
--cc=dmatlack@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oupton@kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=shuah@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox