Patch "kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-vfio-ensure-kvg-instance-stays-around-in-kvm_vfi.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e4538abab83e23f2fd0cbac3a9c7965f929e9932
Author: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Date:   Fri Jul 14 15:45:32 2023 -0700

    kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
    
    [ Upstream commit 9e0f4f2918c2ff145d3dedee862d9919a6ed5812 ]
    
    kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
    and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
    dropping kv->lock. If we race group addition and deletion calls, kvg
    instance may get freed by the time we get around to calling
    kvm_vfio_file_set_kvm().
    
    Previous iterations of the code did not reference kvg->file outside of
    the critical section, but used a temporary variable. Still, they had
    similar problem of the file reference being owned by kvg structure and
    potential for kvm_vfio_group_del() dropping it before
    kvm_vfio_group_add() had a chance to complete.
    
    Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
    of kv->lock. We already call it while holding the same lock when vfio
    group is being deleted, so it should be safe here as well.
    
    Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete")
    Reviewed-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230714224538.404793-1-dmitry.torokhov@xxxxxxxxx
    Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index af3d0cf06e4c6..365d30779768a 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -180,10 +180,10 @@ static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd)
 	list_add_tail(&kvf->node, &kv->file_list);
 
 	kvm_arch_start_assignment(dev->kvm);
+	kvm_vfio_file_set_kvm(kvf->file, dev->kvm);
 
 	mutex_unlock(&kv->lock);
 
-	kvm_vfio_file_set_kvm(kvf->file, dev->kvm);
 	kvm_vfio_update_coherency(dev);
 
 	return 0;