linux/virt/kvm
Paolo Bonzini 85cd39af14 KVM: Do not leak memory for duplicate debugfs directories
KVM creates a debugfs directory for each VM in order to store statistics
about the virtual machine.  The directory name is built from the process
pid and a VM fd.  While generally unique, it is possible to keep a
file descriptor alive in a way that causes duplicate directories, which
manifests as these messages:

  [  471.846235] debugfs: Directory '20245-4' with parent 'kvm' already present!

Even though this should not happen in practice, it is more or less
expected in the case of KVM for testcases that call KVM_CREATE_VM and
close the resulting file descriptor repeatedly and in parallel.

When this happens, debugfs_create_dir() returns an error but
kvm_create_vm_debugfs() goes on to allocate stat data structs which are
later leaked.  The slow memory leak was spotted by syzkaller, where it
caused OOM reports.

Since the issue only affects debugfs, do a lookup before calling
debugfs_create_dir, so that the message is downgraded and rate-limited.
While at it, ensure kvm->debugfs_dentry is NULL rather than an error
if it is not created.  This fixes kvm_destroy_vm_debugfs, which was not
checking IS_ERR_OR_NULL correctly.

Cc: stable@vger.kernel.org
Fixes: 536a6f88c4 ("KVM: Create debugfs dir and stat files for each VM")
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-04 06:02:03 -04:00
..
async_pf.c mm/gup: remove task_struct pointer for all gup code 2020-08-12 10:58:04 -07:00
async_pf.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504 2019-06-19 17:09:56 +02:00
binary_stats.c KVM: stats: Add fd-based API to read binary stats data 2021-06-24 11:47:57 -04:00
coalesced_mmio.c KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio 2021-07-14 12:17:56 -04:00
coalesced_mmio.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dirty_ring.c KVM: x86/mmu: Use an rwlock for the x86 MMU 2021-02-04 05:27:43 -05:00
eventfd.c kvm/eventfd: Drain events from eventfd in irqfd_wakeup() 2020-11-15 09:49:11 -05:00
irqchip.c KVM/arm updates for 5.3 2019-07-11 15:14:16 +02:00
Kconfig kvm: add PM-notifier 2021-06-17 13:09:32 -04:00
kvm_main.c KVM: Do not leak memory for duplicate debugfs directories 2021-08-04 06:02:03 -04:00
mmu_lock.h KVM: x86/mmu: Use an rwlock for the x86 MMU 2021-02-04 05:27:43 -05:00
vfio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
vfio.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00