Re: [PATCH] RISC-V: KVM: Synchronize hrtimer callback during teardown

You're right. I'll add an Assisted-by trailer and drop
[email protected] from the recipients in v2.

Thanks,
Myeonghun

2026년 7월 29일 (수) 오후 5:45, Greg KH <[email protected]>님이 작성:
>
> On Wed, Jul 29, 2026 at 01:42:24AM +0900, Myeonghun Pak wrote:
> > The non-Sstc hrtimer callback clears next_set before its final uses of
> > the enclosing vCPU.  If teardown observes next_set as false while the
> > callback is still running, kvm_riscv_vcpu_timer_cancel() skips
> > hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the
> > callback enters kvm_riscv_vcpu_set_interrupt().
> >
> > A guest can arm the timer with SBI TIME and request shutdown with SBI
> > legacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and
> > destroys the VM supplies the teardown side of the race; no post-launch
> > host ioctl is needed to arm or request teardown.
> >
> > On upstream master 62cc90241548, generic KASAN reported:
> >
> >   BUG: KASAN: slab-use-after-free in do_raw_spin_lock
> >   Write of size 4 at addr ff60000005e58898
> >
> >   kvm_riscv_vcpu_set_interrupt
> >   kvm_riscv_vcpu_hrtimer_expired
> >   __hrtimer_run_queues
> >   hrtimer_interrupt
> >
> > The object was allocated by KVM_CREATE_VCPU and freed concurrently by:
> >
> >   kvm_destroy_vcpus
> >   kvm_arch_destroy_vm
> >   kvm_destroy_vm
> >   __fput
> >
> > For deterministic validation, I added mdelay(1000) immediately after
> > the existing next_set = false assignment.  This only widens the
> > existing post-clear callback window.  A no-delay trace build naturally
> > reached the callback-after-teardown-start/before-deinit ordering in 12
> > of 200 runs, but 1,500 stock-kernel stress iterations did not produce a
> > KASAN report, so natural reproduction is timing-sensitive.
> >
> > Always invoke hrtimer_cancel() for an initialized timer.  Preserve the
> > existing -EINVAL result when the timer is no longer set, but only after
> > synchronizing with a running callback.
> >
> > With this patch, hrtimer_cancel() blocked for the full widened callback
> > window before vCPU destruction.  KASAN reported no error in 100
> > fixed-and-widened runs or 200 fix-only timing-sweep runs.
> >
> > Fixes: 3a9f66cb25e1 ("RISC-V: KVM: Add timer functionality")
> > Cc: [email protected]
> > Signed-off-by: Myeonghun Pak <[email protected]>
> > ---
> >  arch/riscv/kvm/vcpu_timer.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > AI disclosure: I used AI assistance during the audit and am treating the
> > issue as public as required by Documentation/process/security-bugs.rst.
> > The reproducer and full KASAN trace have not been posted publicly and
> > are available on request.
>
> Then don't you need to add an "Assisted-by:" line to your patch?
>
> And as you posted this publicly, no need to cc: [email protected].
>
> thanks,
>
> greg k-h