Patch "KVM: Don't create VM debugfs files outside of the VM directory" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    KVM: Don't create VM debugfs files outside of the VM directory

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-don-t-create-vm-debugfs-files-outside-of-the-vm-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2985ca62cf7ef0744a894c07d95826db41667038
Author: Oliver Upton <oupton@xxxxxxxxxx>
Date:   Wed Apr 6 23:56:13 2022 +0000

    KVM: Don't create VM debugfs files outside of the VM directory
    
    [ Upstream commit a44a4cc1c969afec97dbb2aedaf6f38eaa6253bb ]
    
    Unfortunately, there is no guarantee that KVM was able to instantiate a
    debugfs directory for a particular VM. To that end, KVM shouldn't even
    attempt to create new debugfs files in this case. If the specified
    parent dentry is NULL, debugfs_create_file() will instantiate files at
    the root of debugfs.
    
    For arm64, it is possible to create the vgic-state file outside of a
    VM directory, the file is not cleaned up when a VM is destroyed.
    Nonetheless, the corresponding struct kvm is freed when the VM is
    destroyed.
    
    Nip the problem in the bud for all possible errant debugfs file
    creations by initializing kvm->debugfs_dentry to -ENOENT. In so doing,
    debugfs_create_file() will fail instead of creating the file in the root
    directory.
    
    Cc: stable@xxxxxxxxxx
    Fixes: 929f45e32499 ("kvm: no need to check return value of debugfs_create functions")
    Signed-off-by: Oliver Upton <oupton@xxxxxxxxxx>
    Signed-off-by: Marc Zyngier <maz@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220406235615.1447180-2-oupton@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 99c591569815..9134ae252d7c 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -911,7 +911,7 @@ static void kvm_destroy_vm_debugfs(struct kvm *kvm)
 	int kvm_debugfs_num_entries = kvm_vm_stats_header.num_desc +
 				      kvm_vcpu_stats_header.num_desc;
 
-	if (!kvm->debugfs_dentry)
+	if (IS_ERR(kvm->debugfs_dentry))
 		return;
 
 	debugfs_remove_recursive(kvm->debugfs_dentry);
@@ -934,6 +934,12 @@ static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
 	int kvm_debugfs_num_entries = kvm_vm_stats_header.num_desc +
 				      kvm_vcpu_stats_header.num_desc;
 
+	/*
+	 * Force subsequent debugfs file creations to fail if the VM directory
+	 * is not created.
+	 */
+	kvm->debugfs_dentry = ERR_PTR(-ENOENT);
+
 	if (!debugfs_initialized())
 		return 0;
 
@@ -5373,7 +5379,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
 	}
 	add_uevent_var(env, "PID=%d", kvm->userspace_pid);
 
-	if (kvm->debugfs_dentry) {
+	if (!IS_ERR(kvm->debugfs_dentry)) {
 		char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);
 
 		if (p) {