From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5730DC433F5 for ; Mon, 4 Apr 2022 18:21:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id B84294B2C6; Mon, 4 Apr 2022 14:21:31 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Authentication-Results: mm01.cs.columbia.edu (amavisd-new); dkim=softfail (fail, message has been altered) header.i=@google.com Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kXJmqon0MXt5; Mon, 4 Apr 2022 14:21:30 -0400 (EDT) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 971BD4B23F; Mon, 4 Apr 2022 14:21:30 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id C1A0A4B1CA for ; Mon, 4 Apr 2022 14:21:29 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id brmax97Ol9cO for ; Mon, 4 Apr 2022 14:21:28 -0400 (EDT) Received: from mail-il1-f202.google.com (mail-il1-f202.google.com [209.85.166.202]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id 9DD144B092 for ; Mon, 4 Apr 2022 14:21:28 -0400 (EDT) Received: by mail-il1-f202.google.com with SMTP id s14-20020a056e021a0e00b002c7c03a5d81so6638049ild.9 for ; Mon, 04 Apr 2022 11:21:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=VQaIdErXUgdjfuVxv831Q/UJ1CWc5wWY7lxH3zvCVtXh16fjW923ZCg+YZuUsWju3h 4ILe42584P0T1xmue23EdXWW7PxQVhSS77wXAmPxATMxy/cGsyGIM6bUkch6ZVyRElCQ rYfBdRc5h8GB9QfjxeOjmesVjpoFyeeH8Zu3wSnbSfQxQ3f/BrQJ4KI3CO5dBC0PNy47 Yq8oCV8PCHMfzHfZRdiUAWzfhsKGQ1Hpzi816xxYXKutJYAFxMS/T/Z1CZFLs+IWzaVH muqotKois0KT0BZ6aZswP/2F+KHpolFWLj99t2uLkL2he7pDHDC+m/o+W1S/4MwTh6cX aMtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=KLFvJC0+/FQDxGGOsE0jkTTJW5ICNQslnIIDrYJ2dc8jcwqUmno9CDqtduLEDiRuFA ANYikC6QSbyKoBoKGRZR5/ITlvpK3Iqowxz4uqkbKs5XQOH5Ed0p7djAtFG2HxKRtP1N /vjtIfzUo0jU00QJxJNCF97g5+n3j1sZhJhv2CVyFsJymWQP1vD9ZwdNuWZe2ldkfkeS eaR56A848hAeexshzJA0bhPShzFpEh72SMcIHUCTf568qezdSEtM4gi6WEl+z3kcYdql RWGxai0gQeyt4xthzr4toCUBn9JJ3PC7RURw+rRa3WQgJf1rTrk5cEZNYitOXq8ySust lbbw== X-Gm-Message-State: AOAM533hnLrRDwIdN9LRSdUkNDldLURYd5T8g0VsQz0DhAt958Tv743L YJVjGwwmcaGPSD6FHY/NYWNLclMJoYut/xZu9VM30RwMzOSG2MWDAU4EQoDVYvd0fdii0Dx6vUX +M9frJq8jvRi2LzDFiqHg28wQwMquSC/8xVcazSAUnWFCE2FBjYJcc3Y6lCdobuLyt0Y9RA== X-Google-Smtp-Source: ABdhPJwvPmo526HelrAxxb/UEnfhShlEth+Y810soIVt6pAr1nUtlqyUQGi/Lx6WU18UFIH94tuineOFKlE= X-Received: from oupton.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:404]) (user=oupton job=sendgmr) by 2002:a6b:e40a:0:b0:64c:8ce1:3757 with SMTP id u10-20020a6be40a000000b0064c8ce13757mr727788iog.106.1649096487896; Mon, 04 Apr 2022 11:21:27 -0700 (PDT) Date: Mon, 4 Apr 2022 18:21:16 +0000 Message-Id: <20220404182119.3561025-1-oupton@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1094.g7c7d902a7c-goog Subject: [PATCH v2 0/3] KVM: Fix use-after-free in debugfs From: Oliver Upton To: kvmarm@lists.cs.columbia.edu Cc: kvm@vger.kernel.org, Marc Zyngier , Peter Shier , Paolo Bonzini , linux-arm-kernel@lists.infradead.org X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu Funny enough, dirty_log_perf_test on arm64 highlights some issues around the use of debugfs in KVM. The test leaks a GIC FD across test iterations, and as such the associated VM is never destroyed. Nonetheless, the VM FD is reused for the next VM, which collides with the old debugfs directory. Where things get off is when the vgic-state debugfs file is created. KVM does not check if the VM directory exists before creating the file, which results in the file being added to the root of debugfs when the aforementioned collision occurs. Since KVM relies on deleting the VM directory to clean up all associated files, the errant vgic-state file never gets cleaned up. Poking the file after the VM is destroyed is a use-after-free :) Patch 1 shuts the door on any mistaken debugfs file creations by initializing kvm->debugfs_dentry with ERR_PTR() instead of NULL. The last two patches ensure the GIC FD actually gets closed by the selftests that use it. Patch 2 is a genuine bug fix since it will create multiple VMs for a single test run. The arch_timer test also happens to leak the GIC FD, though it is benign since the test creates a single VM. Patch 3 gets the arch_timer test to follow the well-behaved pattern. Applies cleanly to the second KVM pull (tagged kvm-5.18-2), at commit: c15e0ae42c8e ("KVM: x86: fix sending PV IPI") Tested on an Ampere Altra system in the following combinations: - Bad kernel + fixed selftests - Fixed kernel + bad selftests In both cases there was no vgic-state file at the root of debugfs. v1: https://lore.kernel.org/kvm/20220402174044.2263418-1-oupton@google.com/ v1 -> v2: - Initialize kvm->debugfs_dentry to ERR_PTR(-ENOENT) to prevent the creation of all VM debug files, not just vgic-state. - Leave logging as-is for now. Consider dropping altogether in a later patch (Sean) - Collect R-b from Jing Oliver Upton (3): KVM: Don't create VM debugfs files outside of the VM directory selftests: KVM: Don't leak GIC FD across dirty log test iterations selftests: KVM: Free the GIC FD when cleaning up in arch_timer .../selftests/kvm/aarch64/arch_timer.c | 15 +++++--- .../selftests/kvm/dirty_log_perf_test.c | 34 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 ++++-- 3 files changed, 50 insertions(+), 9 deletions(-) -- 2.35.1.1094.g7c7d902a7c-goog _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7DF12C433EF for ; Mon, 4 Apr 2022 18:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Mime-Version: Message-Id:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=CD12TDhTDRCYHhqWrViQyOVitTfkmEWwavZ0yTWloLM=; b=j+X XqgLp7dLD6QO/nM7KAK9tUBgiaLahkp0szAp3RTi2fQJj9ulF14FpChnxN4M4kF7737qUZu1PU1pV QJ/NK9ZFcgGxf53j7buIfQeTyZEg2kuDJtjJDV7PO43DEOAxhgepMfdjtvSFlL9T7zbRCwijfSuDB ACXZKDdvOgF2YzVUtNjjcuTr6uJIs17inCBr6HwC3C2Nmtbuu2BfFKpXb46YrePCLvTaheHVGS1Hs 1UhDs0m3/bCwI14CuWWIBqD2hNABdZnhkfWKgshWR95/n28LxZdlSnZAJN94YRRaipNrT1g06HwBd qXRpow4jt7MzP4ebWDl73/qmJ6jR8AQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nbRKW-00G7BT-PL; Mon, 04 Apr 2022 18:21:32 +0000 Received: from mail-io1-xd4a.google.com ([2607:f8b0:4864:20::d4a]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nbRKT-00G7AC-S4 for linux-arm-kernel@lists.infradead.org; Mon, 04 Apr 2022 18:21:31 +0000 Received: by mail-io1-xd4a.google.com with SMTP id y3-20020a056602178300b00645d25c30c1so6841056iox.6 for ; Mon, 04 Apr 2022 11:21:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=VQaIdErXUgdjfuVxv831Q/UJ1CWc5wWY7lxH3zvCVtXh16fjW923ZCg+YZuUsWju3h 4ILe42584P0T1xmue23EdXWW7PxQVhSS77wXAmPxATMxy/cGsyGIM6bUkch6ZVyRElCQ rYfBdRc5h8GB9QfjxeOjmesVjpoFyeeH8Zu3wSnbSfQxQ3f/BrQJ4KI3CO5dBC0PNy47 Yq8oCV8PCHMfzHfZRdiUAWzfhsKGQ1Hpzi816xxYXKutJYAFxMS/T/Z1CZFLs+IWzaVH muqotKois0KT0BZ6aZswP/2F+KHpolFWLj99t2uLkL2he7pDHDC+m/o+W1S/4MwTh6cX aMtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=tqaAKdP2eE7fpTimjQszsvSxbd3yR2BaOyVq4PfECL0tC5msHWPCDEg7m50DmjKHm/ E551Q87TnYhBNaLhfitrQM7+QhmYN9NpFXGSdGUn5h9Jw2eh/a9ONJoF85+XPR6aGK+w rZ0dSjRCNWQx7ZTbA5ymbdQ/sGrbQ9DjwXR5E1SgnXLKYYu3ne4lZDFd7Vg/V+VzgFGp LzeLmsQsBUcKXfwa0z6MipCCztwI/MAnrptfVwSybPjwqlXLKL3Okfa2KbtgUAszU7CU R3uN6UfKtw5Zi91L3zWqeRgyMo+R99QH/BuIeN0CXdbUJmNtFVGlZqiffojVarFBtpd7 t45g== X-Gm-Message-State: AOAM532T3Ztju86+PiCJqddKz+j9GVhK6JyWWTA08Q3Db667r5LheieI a+myYz+rpFAKThMz1gDnLHdIV9xIwhE= X-Google-Smtp-Source: ABdhPJwvPmo526HelrAxxb/UEnfhShlEth+Y810soIVt6pAr1nUtlqyUQGi/Lx6WU18UFIH94tuineOFKlE= X-Received: from oupton.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:404]) (user=oupton job=sendgmr) by 2002:a6b:e40a:0:b0:64c:8ce1:3757 with SMTP id u10-20020a6be40a000000b0064c8ce13757mr727788iog.106.1649096487896; Mon, 04 Apr 2022 11:21:27 -0700 (PDT) Date: Mon, 4 Apr 2022 18:21:16 +0000 Message-Id: <20220404182119.3561025-1-oupton@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1094.g7c7d902a7c-goog Subject: [PATCH v2 0/3] KVM: Fix use-after-free in debugfs From: Oliver Upton To: kvmarm@lists.cs.columbia.edu Cc: kvm@vger.kernel.org, Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , linux-arm-kernel@lists.infradead.org, Peter Shier , Ricardo Koller , Reiji Watanabe , Paolo Bonzini , Sean Christopherson , Oliver Upton X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220404_112129_961530_BD49A95F X-CRM114-Status: GOOD ( 14.63 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Funny enough, dirty_log_perf_test on arm64 highlights some issues around the use of debugfs in KVM. The test leaks a GIC FD across test iterations, and as such the associated VM is never destroyed. Nonetheless, the VM FD is reused for the next VM, which collides with the old debugfs directory. Where things get off is when the vgic-state debugfs file is created. KVM does not check if the VM directory exists before creating the file, which results in the file being added to the root of debugfs when the aforementioned collision occurs. Since KVM relies on deleting the VM directory to clean up all associated files, the errant vgic-state file never gets cleaned up. Poking the file after the VM is destroyed is a use-after-free :) Patch 1 shuts the door on any mistaken debugfs file creations by initializing kvm->debugfs_dentry with ERR_PTR() instead of NULL. The last two patches ensure the GIC FD actually gets closed by the selftests that use it. Patch 2 is a genuine bug fix since it will create multiple VMs for a single test run. The arch_timer test also happens to leak the GIC FD, though it is benign since the test creates a single VM. Patch 3 gets the arch_timer test to follow the well-behaved pattern. Applies cleanly to the second KVM pull (tagged kvm-5.18-2), at commit: c15e0ae42c8e ("KVM: x86: fix sending PV IPI") Tested on an Ampere Altra system in the following combinations: - Bad kernel + fixed selftests - Fixed kernel + bad selftests In both cases there was no vgic-state file at the root of debugfs. v1: https://lore.kernel.org/kvm/20220402174044.2263418-1-oupton@google.com/ v1 -> v2: - Initialize kvm->debugfs_dentry to ERR_PTR(-ENOENT) to prevent the creation of all VM debug files, not just vgic-state. - Leave logging as-is for now. Consider dropping altogether in a later patch (Sean) - Collect R-b from Jing Oliver Upton (3): KVM: Don't create VM debugfs files outside of the VM directory selftests: KVM: Don't leak GIC FD across dirty log test iterations selftests: KVM: Free the GIC FD when cleaning up in arch_timer .../selftests/kvm/aarch64/arch_timer.c | 15 +++++--- .../selftests/kvm/dirty_log_perf_test.c | 34 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 ++++-- 3 files changed, 50 insertions(+), 9 deletions(-) -- 2.35.1.1094.g7c7d902a7c-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2544AC38161 for ; Mon, 4 Apr 2022 21:23:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380700AbiDDVVy (ORCPT ); Mon, 4 Apr 2022 17:21:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1379926AbiDDSXZ (ORCPT ); Mon, 4 Apr 2022 14:23:25 -0400 Received: from mail-il1-x149.google.com (mail-il1-x149.google.com [IPv6:2607:f8b0:4864:20::149]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 77B8F22B20 for ; Mon, 4 Apr 2022 11:21:28 -0700 (PDT) Received: by mail-il1-x149.google.com with SMTP id b8-20020a92db08000000b002c9a58332cbso6603024iln.16 for ; Mon, 04 Apr 2022 11:21:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=VQaIdErXUgdjfuVxv831Q/UJ1CWc5wWY7lxH3zvCVtXh16fjW923ZCg+YZuUsWju3h 4ILe42584P0T1xmue23EdXWW7PxQVhSS77wXAmPxATMxy/cGsyGIM6bUkch6ZVyRElCQ rYfBdRc5h8GB9QfjxeOjmesVjpoFyeeH8Zu3wSnbSfQxQ3f/BrQJ4KI3CO5dBC0PNy47 Yq8oCV8PCHMfzHfZRdiUAWzfhsKGQ1Hpzi816xxYXKutJYAFxMS/T/Z1CZFLs+IWzaVH muqotKois0KT0BZ6aZswP/2F+KHpolFWLj99t2uLkL2he7pDHDC+m/o+W1S/4MwTh6cX aMtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=8WwwRyCeCeMlIzr9SxYzcSTADq8P7PlbsRggytaLcp4=; b=3SWP+DaiMkknvjHkHRmuPAxUV1fdsD0YMKnaw5kaf8gKBWsZGx6PPmKSdRtnUJJRsc IPCEibLA50Jdc+kjlcWlf+l7rRzVTIwRDOYNh2DdOnAcLVSQj16LVWm0/xaDoRlWs+7D tiIypOXemZCuCFYtydetS5UBV7savHVweR61AfbF+q2bhgdDdyx1JA25XuUydcJfLsAY roLPfNxquqLidpz6rzOfUei8AE1igod/3jdAlca9wuNQ9a0ZdAHlfx8hlmWlFUyQeezm ifTOwIIjo3nida59hQtHuIY8Dsx0ynPumEMM81CzzQrqDkUW+A18jv1ED0InVHJ3MuzD u5+g== X-Gm-Message-State: AOAM530z61XMqMoHBpSlxZCihg4UbHsERzf3TK8aGdwjUEHFwSCQwNti b6ARkeUbyWngUeBvQfr9bna8Krrav3Q= X-Google-Smtp-Source: ABdhPJwvPmo526HelrAxxb/UEnfhShlEth+Y810soIVt6pAr1nUtlqyUQGi/Lx6WU18UFIH94tuineOFKlE= X-Received: from oupton.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:404]) (user=oupton job=sendgmr) by 2002:a6b:e40a:0:b0:64c:8ce1:3757 with SMTP id u10-20020a6be40a000000b0064c8ce13757mr727788iog.106.1649096487896; Mon, 04 Apr 2022 11:21:27 -0700 (PDT) Date: Mon, 4 Apr 2022 18:21:16 +0000 Message-Id: <20220404182119.3561025-1-oupton@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1094.g7c7d902a7c-goog Subject: [PATCH v2 0/3] KVM: Fix use-after-free in debugfs From: Oliver Upton To: kvmarm@lists.cs.columbia.edu Cc: kvm@vger.kernel.org, Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , linux-arm-kernel@lists.infradead.org, Peter Shier , Ricardo Koller , Reiji Watanabe , Paolo Bonzini , Sean Christopherson , Oliver Upton Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Funny enough, dirty_log_perf_test on arm64 highlights some issues around the use of debugfs in KVM. The test leaks a GIC FD across test iterations, and as such the associated VM is never destroyed. Nonetheless, the VM FD is reused for the next VM, which collides with the old debugfs directory. Where things get off is when the vgic-state debugfs file is created. KVM does not check if the VM directory exists before creating the file, which results in the file being added to the root of debugfs when the aforementioned collision occurs. Since KVM relies on deleting the VM directory to clean up all associated files, the errant vgic-state file never gets cleaned up. Poking the file after the VM is destroyed is a use-after-free :) Patch 1 shuts the door on any mistaken debugfs file creations by initializing kvm->debugfs_dentry with ERR_PTR() instead of NULL. The last two patches ensure the GIC FD actually gets closed by the selftests that use it. Patch 2 is a genuine bug fix since it will create multiple VMs for a single test run. The arch_timer test also happens to leak the GIC FD, though it is benign since the test creates a single VM. Patch 3 gets the arch_timer test to follow the well-behaved pattern. Applies cleanly to the second KVM pull (tagged kvm-5.18-2), at commit: c15e0ae42c8e ("KVM: x86: fix sending PV IPI") Tested on an Ampere Altra system in the following combinations: - Bad kernel + fixed selftests - Fixed kernel + bad selftests In both cases there was no vgic-state file at the root of debugfs. v1: https://lore.kernel.org/kvm/20220402174044.2263418-1-oupton@google.com/ v1 -> v2: - Initialize kvm->debugfs_dentry to ERR_PTR(-ENOENT) to prevent the creation of all VM debug files, not just vgic-state. - Leave logging as-is for now. Consider dropping altogether in a later patch (Sean) - Collect R-b from Jing Oliver Upton (3): KVM: Don't create VM debugfs files outside of the VM directory selftests: KVM: Don't leak GIC FD across dirty log test iterations selftests: KVM: Free the GIC FD when cleaning up in arch_timer .../selftests/kvm/aarch64/arch_timer.c | 15 +++++--- .../selftests/kvm/dirty_log_perf_test.c | 34 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 ++++-- 3 files changed, 50 insertions(+), 9 deletions(-) -- 2.35.1.1094.g7c7d902a7c-goog