* [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features
@ 2026-08-13 23:25 Tao Cui
2026-08-14 1:08 ` Bibo Mao
0 siblings, 1 reply; 4+ messages in thread
From: Tao Cui @ 2026-08-13 23:25 UTC (permalink / raw)
To: maobibo
Cc: zhaotianrui, chenhuacai, kvm, loongarch, linux-kernel, cui.tao,
Tao Cui
From: Tao Cui <cuitao@kylinos.cn>
The check-then-set on kvm->arch.pv_features in
kvm_loongarch_cpucfg_set_attr() is lockless, so two vCPUs can race
past the validation and set different values. Add a spinlock to
serialize it.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
Changes in v2: use a spinlock instead of a cmpxchg loop (Bibo Mao).
Link: https://lore.kernel.org/all/20260810081321.157258-1-cui.tao@linux.dev/
arch/loongarch/include/asm/kvm_host.h | 2 ++
arch/loongarch/kvm/vcpu.c | 6 +++++-
arch/loongarch/kvm/vm.c | 1 +
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/include/asm/kvm_host.h b/arch/loongarch/include/asm/kvm_host.h
index 23cfbecebbd7..cdbbd90e0584 100644
--- a/arch/loongarch/include/asm/kvm_host.h
+++ b/arch/loongarch/include/asm/kvm_host.h
@@ -128,6 +128,8 @@ struct kvm_arch {
struct kvm_phyid_map *phyid_map;
/* Enabled PV features */
unsigned long pv_features;
+ /* Serializes pv_features updates */
+ spinlock_t pv_features_lock;
/* Supported KVM features */
unsigned long kvm_features;
diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index 20c207d80e31..551ed39b2d1f 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -1165,10 +1165,14 @@ static int kvm_loongarch_cpucfg_set_attr(struct kvm_vcpu *vcpu,
return -EINVAL;
/* All vCPUs need set the same PV features */
+ spin_lock(&kvm->arch.pv_features_lock);
if ((kvm->arch.pv_features & LOONGARCH_PV_FEAT_UPDATED)
- && ((kvm->arch.pv_features & valid) != val))
+ && ((kvm->arch.pv_features & valid) != val)) {
+ spin_unlock(&kvm->arch.pv_features_lock);
return -EINVAL;
+ }
kvm->arch.pv_features = val | LOONGARCH_PV_FEAT_UPDATED;
+ spin_unlock(&kvm->arch.pv_features_lock);
return 0;
default:
return -ENXIO;
diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
index 1317c718f896..b984cc54f305 100644
--- a/arch/loongarch/kvm/vm.c
+++ b/arch/loongarch/kvm/vm.c
@@ -76,6 +76,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
return -ENOMEM;
}
spin_lock_init(&kvm->arch.phyid_map_lock);
+ spin_lock_init(&kvm->arch.pv_features_lock);
kvm_init_vmcs(kvm);
kvm_vm_init_features(kvm);
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features
2026-08-13 23:25 [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features Tao Cui
@ 2026-08-14 1:08 ` Bibo Mao
2026-08-14 8:24 ` Huacai Chen
0 siblings, 1 reply; 4+ messages in thread
From: Bibo Mao @ 2026-08-14 1:08 UTC (permalink / raw)
To: Tao Cui; +Cc: zhaotianrui, chenhuacai, kvm, loongarch, linux-kernel, Tao Cui
On 2026/8/14 上午7:25, Tao Cui wrote:
> From: Tao Cui <cuitao@kylinos.cn>
>
> The check-then-set on kvm->arch.pv_features in
> kvm_loongarch_cpucfg_set_attr() is lockless, so two vCPUs can race
> past the validation and set different values. Add a spinlock to
> serialize it.
>
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>
> Changes in v2: use a spinlock instead of a cmpxchg loop (Bibo Mao).
> Link: https://lore.kernel.org/all/20260810081321.157258-1-cui.tao@linux.dev/
>
> arch/loongarch/include/asm/kvm_host.h | 2 ++
> arch/loongarch/kvm/vcpu.c | 6 +++++-
> arch/loongarch/kvm/vm.c | 1 +
> 3 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/arch/loongarch/include/asm/kvm_host.h b/arch/loongarch/include/asm/kvm_host.h
> index 23cfbecebbd7..cdbbd90e0584 100644
> --- a/arch/loongarch/include/asm/kvm_host.h
> +++ b/arch/loongarch/include/asm/kvm_host.h
> @@ -128,6 +128,8 @@ struct kvm_arch {
> struct kvm_phyid_map *phyid_map;
> /* Enabled PV features */
> unsigned long pv_features;
> + /* Serializes pv_features updates */
> + spinlock_t pv_features_lock;
> /* Supported KVM features */
> unsigned long kvm_features;
>
> diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
> index 20c207d80e31..551ed39b2d1f 100644
> --- a/arch/loongarch/kvm/vcpu.c
> +++ b/arch/loongarch/kvm/vcpu.c
> @@ -1165,10 +1165,14 @@ static int kvm_loongarch_cpucfg_set_attr(struct kvm_vcpu *vcpu,
> return -EINVAL;
>
> /* All vCPUs need set the same PV features */
> + spin_lock(&kvm->arch.pv_features_lock);
> if ((kvm->arch.pv_features & LOONGARCH_PV_FEAT_UPDATED)
> - && ((kvm->arch.pv_features & valid) != val))
> + && ((kvm->arch.pv_features & valid) != val)) {
> + spin_unlock(&kvm->arch.pv_features_lock);
> return -EINVAL;
> + }
> kvm->arch.pv_features = val | LOONGARCH_PV_FEAT_UPDATED;
> + spin_unlock(&kvm->arch.pv_features_lock);
> return 0;
> default:
> return -ENXIO;
> diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
> index 1317c718f896..b984cc54f305 100644
> --- a/arch/loongarch/kvm/vm.c
> +++ b/arch/loongarch/kvm/vm.c
> @@ -76,6 +76,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
> return -ENOMEM;
> }
> spin_lock_init(&kvm->arch.phyid_map_lock);
> + spin_lock_init(&kvm->arch.pv_features_lock);
>
> kvm_init_vmcs(kvm);
> kvm_vm_init_features(kvm);
>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features
2026-08-14 1:08 ` Bibo Mao
@ 2026-08-14 8:24 ` Huacai Chen
2026-08-14 9:28 ` Tao Cui
0 siblings, 1 reply; 4+ messages in thread
From: Huacai Chen @ 2026-08-14 8:24 UTC (permalink / raw)
To: Bibo Mao; +Cc: Tao Cui, zhaotianrui, kvm, loongarch, linux-kernel, Tao Cui
Hi, Tao,
On Fri, Aug 14, 2026 at 9:09 AM Bibo Mao <maobibo@loongson.cn> wrote:
>
>
>
> On 2026/8/14 上午7:25, Tao Cui wrote:
> > From: Tao Cui <cuitao@kylinos.cn>
> >
> > The check-then-set on kvm->arch.pv_features in
> > kvm_loongarch_cpucfg_set_attr() is lockless, so two vCPUs can race
> > past the validation and set different values. Add a spinlock to
> > serialize it.
> >
> > Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> > ---
> >
> > Changes in v2: use a spinlock instead of a cmpxchg loop (Bibo Mao).
> > Link: https://lore.kernel.org/all/20260810081321.157258-1-cui.tao@linux.dev/
> >
> > arch/loongarch/include/asm/kvm_host.h | 2 ++
> > arch/loongarch/kvm/vcpu.c | 6 +++++-
> > arch/loongarch/kvm/vm.c | 1 +
> > 3 files changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/loongarch/include/asm/kvm_host.h b/arch/loongarch/include/asm/kvm_host.h
> > index 23cfbecebbd7..cdbbd90e0584 100644
> > --- a/arch/loongarch/include/asm/kvm_host.h
> > +++ b/arch/loongarch/include/asm/kvm_host.h
> > @@ -128,6 +128,8 @@ struct kvm_arch {
> > struct kvm_phyid_map *phyid_map;
> > /* Enabled PV features */
> > unsigned long pv_features;
> > + /* Serializes pv_features updates */
> > + spinlock_t pv_features_lock;
I think it is better to rename it to pv_setting_lock, and put it near
phyid_map_lock.
Huacai
> > /* Supported KVM features */
> > unsigned long kvm_features;
> >
> > diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
> > index 20c207d80e31..551ed39b2d1f 100644
> > --- a/arch/loongarch/kvm/vcpu.c
> > +++ b/arch/loongarch/kvm/vcpu.c
> > @@ -1165,10 +1165,14 @@ static int kvm_loongarch_cpucfg_set_attr(struct kvm_vcpu *vcpu,
> > return -EINVAL;
> >
> > /* All vCPUs need set the same PV features */
> > + spin_lock(&kvm->arch.pv_features_lock);
> > if ((kvm->arch.pv_features & LOONGARCH_PV_FEAT_UPDATED)
> > - && ((kvm->arch.pv_features & valid) != val))
> > + && ((kvm->arch.pv_features & valid) != val)) {
> > + spin_unlock(&kvm->arch.pv_features_lock);
> > return -EINVAL;
> > + }
> > kvm->arch.pv_features = val | LOONGARCH_PV_FEAT_UPDATED;
> > + spin_unlock(&kvm->arch.pv_features_lock);
> > return 0;
> > default:
> > return -ENXIO;
> > diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
> > index 1317c718f896..b984cc54f305 100644
> > --- a/arch/loongarch/kvm/vm.c
> > +++ b/arch/loongarch/kvm/vm.c
> > @@ -76,6 +76,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
> > return -ENOMEM;
> > }
> > spin_lock_init(&kvm->arch.phyid_map_lock);
> > + spin_lock_init(&kvm->arch.pv_features_lock);
> >
> > kvm_init_vmcs(kvm);
> > kvm_vm_init_features(kvm);
> >
> Reviewed-by: Bibo Mao <maobibo@loongson.cn>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features
2026-08-14 8:24 ` Huacai Chen
@ 2026-08-14 9:28 ` Tao Cui
0 siblings, 0 replies; 4+ messages in thread
From: Tao Cui @ 2026-08-14 9:28 UTC (permalink / raw)
To: Huacai Chen, Bibo Mao
Cc: cui.tao, zhaotianrui, kvm, loongarch, linux-kernel, Tao Cui
Hi Huacai,
在 2026/8/14 16:24, Huacai Chen 写道:
> Hi, Tao,
>
> On Fri, Aug 14, 2026 at 9:09 AM Bibo Mao <maobibo@loongson.cn> wrote:
>>
>>
>>
>> On 2026/8/14 上午7:25, Tao Cui wrote:
>>> From: Tao Cui <cuitao@kylinos.cn>
>>>
>>> The check-then-set on kvm->arch.pv_features in
>>> kvm_loongarch_cpucfg_set_attr() is lockless, so two vCPUs can race
>>> past the validation and set different values. Add a spinlock to
>>> serialize it.
>>>
>>> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
>>> ---
>>>
>>> Changes in v2: use a spinlock instead of a cmpxchg loop (Bibo Mao).
>>> Link: https://lore.kernel.org/all/20260810081321.157258-1-cui.tao@linux.dev/
>>>
>>> arch/loongarch/include/asm/kvm_host.h | 2 ++
>>> arch/loongarch/kvm/vcpu.c | 6 +++++-
>>> arch/loongarch/kvm/vm.c | 1 +
>>> 3 files changed, 8 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/arch/loongarch/include/asm/kvm_host.h b/arch/loongarch/include/asm/kvm_host.h
>>> index 23cfbecebbd7..cdbbd90e0584 100644
>>> --- a/arch/loongarch/include/asm/kvm_host.h
>>> +++ b/arch/loongarch/include/asm/kvm_host.h
>>> @@ -128,6 +128,8 @@ struct kvm_arch {
>>> struct kvm_phyid_map *phyid_map;
>>> /* Enabled PV features */
>>> unsigned long pv_features;
>>> + /* Serializes pv_features updates */
>>> + spinlock_t pv_features_lock;
> I think it is better to rename it to pv_setting_lock, and put it near
> phyid_map_lock.
>
Got it, v3 on the way with the rename and the lock moved.
Thanks,
Tao
> Huacai
>
>>> /* Supported KVM features */
>>> unsigned long kvm_features;
>>>
>>> diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
>>> index 20c207d80e31..551ed39b2d1f 100644
>>> --- a/arch/loongarch/kvm/vcpu.c
>>> +++ b/arch/loongarch/kvm/vcpu.c
>>> @@ -1165,10 +1165,14 @@ static int kvm_loongarch_cpucfg_set_attr(struct kvm_vcpu *vcpu,
>>> return -EINVAL;
>>>
>>> /* All vCPUs need set the same PV features */
>>> + spin_lock(&kvm->arch.pv_features_lock);
>>> if ((kvm->arch.pv_features & LOONGARCH_PV_FEAT_UPDATED)
>>> - && ((kvm->arch.pv_features & valid) != val))
>>> + && ((kvm->arch.pv_features & valid) != val)) {
>>> + spin_unlock(&kvm->arch.pv_features_lock);
>>> return -EINVAL;
>>> + }
>>> kvm->arch.pv_features = val | LOONGARCH_PV_FEAT_UPDATED;
>>> + spin_unlock(&kvm->arch.pv_features_lock);
>>> return 0;
>>> default:
>>> return -ENXIO;
>>> diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
>>> index 1317c718f896..b984cc54f305 100644
>>> --- a/arch/loongarch/kvm/vm.c
>>> +++ b/arch/loongarch/kvm/vm.c
>>> @@ -76,6 +76,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
>>> return -ENOMEM;
>>> }
>>> spin_lock_init(&kvm->arch.phyid_map_lock);
>>> + spin_lock_init(&kvm->arch.pv_features_lock);
>>>
>>> kvm_init_vmcs(kvm);
>>> kvm_vm_init_features(kvm);
>>>
>> Reviewed-by: Bibo Mao <maobibo@loongson.cn>
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-14 9:28 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-13 23:25 [PATCH v2] LoongArch: KVM: Fix TOCTOU race on pv_features Tao Cui
2026-08-14 1:08 ` Bibo Mao
2026-08-14 8:24 ` Huacai Chen
2026-08-14 9:28 ` Tao Cui
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox