Protect the vm_list walks in kvm_arch_enable_virtualization_cpu() with RCU, publish and remove VMs with RCU list operations, and wait for pre-existing readers before tearing down a VM. The change that introduced kvm_usage_lock replaced kvm_lock with a dedicated usage-count mutex when enabling virtualization. Because vm_list mutators do not take the usage-count mutex, this left the x86 walks without lifetime protection. During CPU online, the hotplug thread can load a VM from vm_list. A concurrent close of the last VM file can then remove that VM and destroy its vCPUs before the hotplug thread dereferences the stale VM or vCPU. Reacquiring kvm_lock from the CPU-hotplug path would restore the lock cycle that the same change fixed. KASAN reported: BUG: KASAN: wild-memory-access in kvm_arch_enable_virtualization_cpu+0x25f/0x870 Read of size 4 at addr dead0000000000f0 by task cpuhp/3/31 Call Trace: kvm_arch_enable_virtualization_cpu+0x25f/0x870 kvm_online_cpu+0x1a/0x50 cpuhp_invoke_callback+0x291/0xfd0 cpuhp_thread_fun+0x256/0x4a0 smpboot_thread_fn+0x287/0x6c0 Fixes: 44d174596260 ("KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock") Cc: stable@vger.kernel.org Assisted-by: GPT-6-Astra Signed-off-by: Chengfeng Ye Signed-off-by: Qi Zhang --- Changes in v2: - Rebase onto current kvm-x86/next; keep the same RCU lifetime fix. - Clarify the scope of the Sashiko finding: the hotplug update of tsc_offset_adjustment and the vCPU-load read/reset are unchanged by this patch. RCU protects VM/vCPU lifetime; it does not synchronize those field accesses. A separate synchronization change would need its own analysis and review. Link: https://lore.kernel.org/r/20260804123243.2213854-1-marsy12010123@gmail.com/ [v1] Link: https://lore.kernel.org/r/20260804125109.B20491F000E9@smtp.kernel.org/ [review] arch/x86/kvm/x86.c | 6 ++++-- virt/kvm/kvm_main.c | 5 +++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 1705e7be46ec..6f57374dbb16 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9664,7 +9664,8 @@ int kvm_arch_enable_virtualization_cpu(void) local_tsc = rdtsc(); stable = !kvm_check_tsc_unstable(); - list_for_each_entry(kvm, &vm_list, vm_list) { + rcu_read_lock(); + list_for_each_entry_rcu(kvm, &vm_list, vm_list) { kvm_for_each_vcpu(i, vcpu, kvm) { if (!stable && vcpu->cpu == smp_processor_id()) kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu); @@ -9716,7 +9717,7 @@ int kvm_arch_enable_virtualization_cpu(void) */ if (backwards_tsc) { u64 delta_cyc = max_tsc - local_tsc; - list_for_each_entry(kvm, &vm_list, vm_list) { + list_for_each_entry_rcu(kvm, &vm_list, vm_list) { kvm->arch.backwards_tsc_observed = true; kvm_for_each_vcpu(i, vcpu, kvm) { vcpu->arch.tsc_offset_adjustment += delta_cyc; @@ -9735,6 +9736,7 @@ int kvm_arch_enable_virtualization_cpu(void) } } + rcu_read_unlock(); return 0; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 9fff2f4bf2f1..750ee2f8c720 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1217,7 +1217,7 @@ static struct kvm *kvm_create_vm(unsigned long type, const char *fdname) goto out_err_no_debugfs; mutex_lock(&kvm_lock); - list_add(&kvm->vm_list, &vm_list); + list_add_rcu(&kvm->vm_list, &vm_list); mutex_unlock(&kvm_lock); preempt_notifier_inc(); @@ -1279,8 +1279,9 @@ static void kvm_destroy_vm(struct kvm *kvm) kvm_uevent_notify_change(KVM_EVENT_DESTROY_VM, kvm); kvm_destroy_vm_debugfs(kvm); mutex_lock(&kvm_lock); - list_del(&kvm->vm_list); + list_del_rcu(&kvm->vm_list); mutex_unlock(&kvm_lock); + synchronize_rcu(); kvm_arch_pre_destroy_vm(kvm); kvm_free_irq_routing(kvm); -- 2.43.0