[PATCH] KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

On 8/6/26 16:51, Paolo Bonzini wrote:
> The second issue needs particular care because the owner could disappear
> altogether (even though the race window is impossibly small) between
> reading it and locking it.  There is thus no way to perform the checks
> under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU
> (which would allow kvm_get_kvm_safe() under RCU critical section).
>
> It is much simpler to just use a global lock, since the critical
> sections are so small and the new lock is always a leaf lock.

Yes — the re-check could never run before the UAF itself, so a single
leaf lock is cleaner.  All writers now serialize on sev_mirror_lock,
closing both issues.

> +	mutex_lock(&sev_mirror_lock);
> +	owner_kvm = sev->enc_context_owner;
> +	list_del(&sev->mirror_entry);
> +	sev->enc_context_owner = NULL;
> +	mutex_unlock(&sev_mirror_lock);
> +	kvm_put_kvm(owner_kvm);

Keeping the put outside the lock also avoids re-entering
sev_vm_destroy() when the mirror holds the last reference.  Looks good.

Thanks for fixing this properly.
Shen