Commit 76021e96 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: Protect vcpu->pid dereference via debugfs with RCU 

Wrap the vcpu->pid dereference in the debugfs hook vcpu_get_pid() with
proper RCU read (un)lock.  Unlike the code in kvm_vcpu_ioctl(),
vcpu_get_pid() is not a simple access; the pid pointer is passed to
pid_nr() and fully dereferenced if the pointer is non-NULL.

Failure to acquire RCU could result in use-after-free of the old pid if
a different task invokes KVM_RUN and puts the last reference to the old
vcpu->pid between vcpu_get_pid() reading the pointer and dereferencing it
in pid_nr().

Fixes: e36de87d ("KVM: debugfs: expose pid of vcpu threads")
Link: https://lore.kernel.org/r/20230211010719.982919-1-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent b9846a69

virt/kvm/kvm_main.c

+4 −1
Original line number Diff line number Diff line
@@ -3870,7 +3870,10 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu) 
static int vcpu_get_pid(void *data, u64 *val)

{

	struct kvm_vcpu *vcpu = data;

	*val = pid_nr(rcu_access_pointer(vcpu->pid));



	rcu_read_lock();

	*val = pid_nr(rcu_dereference(vcpu->pid));

	rcu_read_unlock();

	return 0;

}