• Sean Christopherson's avatar
    KVM: Set file_operations.owner appropriately for all such structures · 087e1520
    Sean Christopherson authored
    Set .owner for all KVM-owned filed types so that the KVM module is pinned
    until any files with callbacks back into KVM are completely freed.  Using
    "struct kvm" as a proxy for the module, i.e. keeping KVM-the-module alive
    while there are active VMs, doesn't provide full protection.
    
    Userspace can invoke delete_module() the instant the last reference to KVM
    is put.  If KVM itself puts the last reference, e.g. via kvm_destroy_vm(),
    then it's possible for KVM to be preempted and deleted/unloaded before KVM
    fully exits, e.g. when the task running kvm_destroy_vm() is scheduled back
    in, it will jump to a code page that is no longer mapped.
    
    Note, file types that can call into sub-module code, e.g. kvm-intel.ko or
    kvm-amd.ko on x86, must use the module pointer passed to kvm_init(), not
    THIS_MODULE (which points at kvm.ko).  KVM assumes that if /dev/kvm is
    reachable, e.g. VMs are active, then the vendor module is loaded.
    
    To reduce the probability of forgetting to set .owner entirely, use
    THIS_MODULE for stats files where KVM does not call back into vendor code.
    
    This reverts commit 70375c2d, and fixes
    several other file types that have been buggy since their introduction.
    
    Fixes: 70375c2d ("Revert "KVM: set owner of cpu and vm file operations"")
    Fixes: 3bcd0662 ("KVM: X86: Introduce mmu_rmaps_stat per-vm debugfs file")
    Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Link: https://lore.kernel.org/all/20231010003746.GN800259@ZenIV
    Link: https://lore.kernel.org/r/20231018204624.1905300-2-seanjc@google.comSigned-off-by: default avatarSean Christopherson <seanjc@google.com>
    087e1520
kvm_main.c 156 KB