[PATCH 0/2] drm/i915/gvt: Fix for KVM refcounting bug

[PATCH 0/2] drm/i915/gvt: Fix for KVM refcounting bug

[Sean Christopherson]

Bug fix and cleanup related to KVM refcounting.  Found by inspection while
attempting to clean up KVM's page-tracker APIs.

Compile tested only!

Sean Christopherson (2):
  drm/i915/gvt: Get reference to KVM iff attachment to VM is successful
  drm/i915/gvt: Unconditionally put reference to KVM when detaching vGPU

 drivers/gpu/drm/i915/gvt/kvmgt.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)


base-commit: 1767a722a708f1fa3b9af39eb091d79101f8c086
-- 
2.38.1.431.g37b22c650d-goog

[PATCH 1/2] drm/i915/gvt: Get reference to KVM iff attachment to VM is successful

[Sean Christopherson]

Get a reference to KVM if and only if a vGPU is successfully attached to
the VM to avoid leaking a reference if there's no available vGPU.  On
open_device() failure, vfio_device_open() doesn't invoke close_device().

Fixes: 421cfe6596f6 ("vfio: remove VFIO_GROUP_NOTIFY_SET_KVM")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 drivers/gpu/drm/i915/gvt/kvmgt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 7a45e5360caf..e67d5267fde0 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -664,8 +664,6 @@ static int intel_vgpu_open_device(struct vfio_device *vfio_dev)
 		return -ESRCH;
 	}
 
-	kvm_get_kvm(vgpu->vfio_device.kvm);
-
 	if (__kvmgt_vgpu_exist(vgpu))
 		return -EEXIST;
 
@@ -676,6 +674,7 @@ static int intel_vgpu_open_device(struct vfio_device *vfio_dev)
 
 	vgpu->track_node.track_write = kvmgt_page_track_write;
 	vgpu->track_node.track_flush_slot = kvmgt_page_track_flush_slot;
+	kvm_get_kvm(vgpu->vfio_device.kvm);
 	kvm_page_track_register_notifier(vgpu->vfio_device.kvm,
 					 &vgpu->track_node);
 
-- 
2.38.1.431.g37b22c650d-goog

[PATCH 2/2] drm/i915/gvt: Unconditionally put reference to KVM when detaching vGPU

[Sean Christopherson]

Always put the KVM reference when closing a vCPU device, as
intel_vgpu_open_device() succeeds if and only if the KVM pointer is
valid and a reference to KVM is acquired.  And if that doesn't hold true,
the call to kvm_page_track_unregister_notifier() a few lines earlier is
doomed.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 drivers/gpu/drm/i915/gvt/kvmgt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index e67d5267fde0..714221f9a131 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -714,15 +714,14 @@ static void intel_vgpu_close_device(struct vfio_device *vfio_dev)
 
 	kvm_page_track_unregister_notifier(vgpu->vfio_device.kvm,
 					   &vgpu->track_node);
+	kvm_put_kvm(vgpu->vfio_device.kvm);
+
 	kvmgt_protect_table_destroy(vgpu);
 	gvt_cache_destroy(vgpu);
 
 	intel_vgpu_release_msi_eventfd_ctx(vgpu);
 
 	vgpu->attached = false;
-
-	if (vgpu->vfio_device.kvm)
-		kvm_put_kvm(vgpu->vfio_device.kvm);
 }
 
 static u64 intel_vgpu_get_bar_addr(struct intel_vgpu *vgpu, int bar)
-- 
2.38.1.431.g37b22c650d-goog

RE: [PATCH 1/2] drm/i915/gvt: Get reference to KVM iff attachment to VM is successful

[Tian, Kevin]

> From: Sean Christopherson
> Sent: Friday, November 11, 2022 8:22 AM
> 
> Get a reference to KVM if and only if a vGPU is successfully attached to
> the VM to avoid leaking a reference if there's no available vGPU.  On
> open_device() failure, vfio_device_open() doesn't invoke close_device().
> 
> Fixes: 421cfe6596f6 ("vfio: remove VFIO_GROUP_NOTIFY_SET_KVM")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

RE: [PATCH 2/2] drm/i915/gvt: Unconditionally put reference to KVM when detaching vGPU

[Tian, Kevin]

> From: Sean Christopherson <seanjc@google.com>
> Sent: Friday, November 11, 2022 8:22 AM
> 
> Always put the KVM reference when closing a vCPU device, as
> intel_vgpu_open_device() succeeds if and only if the KVM pointer is
> valid and a reference to KVM is acquired.  And if that doesn't hold true,
> the call to kvm_page_track_unregister_notifier() a few lines earlier is
> doomed.
> 
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

Re: [PATCH 0/2] drm/i915/gvt: Fix for KVM refcounting bug

[Zhenyu Wang]

[-- Attachment #1: Type: text/plain, Size: 623 bytes --]

On 2022.11.11 00:22:23 +0000, Sean Christopherson wrote:
> Bug fix and cleanup related to KVM refcounting.  Found by inspection while
> attempting to clean up KVM's page-tracker APIs.
> 
> Compile tested only!
> 
> Sean Christopherson (2):
>   drm/i915/gvt: Get reference to KVM iff attachment to VM is successful
>   drm/i915/gvt: Unconditionally put reference to KVM when detaching vGPU
> 
>  drivers/gpu/drm/i915/gvt/kvmgt.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 

Thanks, Sean! and Kevin's review. Pushed this to fixes tree, will issue
regression test before going upstream.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]