Re: [PATCH] vfio: Use file-based reference counting for KVM

On Wed, Aug 12, 2026, [email protected] wrote:
> > diff --git a/arch/x86/kvm/mmu/page_track.c b/arch/x86/kvm/mmu/page_track.c
> > index 7e8195a311bb0..98f133e4f0b32 100644
> > --- a/arch/x86/kvm/mmu/page_track.c
> > +++ b/arch/x86/kvm/mmu/page_track.c
> > @@ -237,10 +237,11 @@ static int kvm_enable_external_write_tracking(struct kvm *kvm)
> 
> [Severity: High]
> This is a pre-existing issue, but does kvm_enable_external_write_tracking()
> need to hold srcu_read_lock(&kvm->srcu) when iterating over the memslots
> array?
> 
> Looking at the function, it retrieves and iterates over the memslots array
> while only holding the slots_arch_lock mutex:
> 
> mutex_lock(&kvm->slots_arch_lock);
> ...
> for (i = 0; i < kvm_arch_nr_memslot_as_ids(kvm); i++) {
>     slots = __kvm_memslots(kvm, i);
>     kvm_for_each_memslot(slot, bkt, slots) {
>         r = kvm_page_track_write_tracking_alloc(slot);
>         if (r)
>             goto out_unlock;
>     }
> }
> 
> Without holding srcu_read_lock(&kvm->srcu) or the writer-side slots_lock,
> could a concurrent memslot update swap and free the memslots array while
> the loop is traversing it, causing a use-after-free?

No, because the part of kvm_swap_active_memslots() that performs the actual swap
runs with slots_arch_lock held.