NetBSD Problem Report #60544

From www@netbsd.org  Thu Aug  6 01:18:51 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 982C71A9249
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  6 Aug 2026 01:18:51 +0000 (UTC)
Message-Id: <20260806011849.99AC11A924A@mollari.NetBSD.org>
Date: Thu,  6 Aug 2026 01:18:49 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: nvmm_vcpu_run: use after mutex release
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60544
>Category:       kern
>Synopsis:       nvmm_vcpu_run: use after mutex release
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 06 01:20:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Aug 08 15:04:51 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9
>Organization:
Acme VM Stoppers, Inc.
>Environment:
>Description:
    666 	error = nvmm_vcpu_get(mach, args->cpuid, &vcpu);
    667 	if (error)
    668 		goto out;
    669 
    670 	error = nvmm_do_vcpu_run(mach, vcpu, &args->exit);
    671 	nvmm_vcpu_put(vcpu);
...
    675 	if (vcpu)
    676 		vcpu->comm->stop = 0;

https://nxr.netbsd.org/xref/src/sys/dev/nvmm/nvmm.c?r=1.48#655

	Unclear why vcpu->comm->stop is supposed to happen so late and
	not immediately after nvmm_do_vcpu_run returns before we
	invalidate vcpu by nvmm_vcpu_put(vcpu).

	Reported by maxv.

>How-To-Repeat:

	code inspection

>Fix:

	Move the vcpu->comm->stop = 0 earlier.

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60544 CVS commit: src/sys/dev/nvmm
Date: Sat, 8 Aug 2026 12:51:35 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug  8 12:51:34 UTC 2026

 Modified Files:
 	src/sys/dev/nvmm: nvmm.c

 Log Message:
 nvmm(4): Fix race in clearing vcpu->comm->stop bit.

 Don't touch vcpu after nvmm_vcpu_put when we no longer hold the lock,
 and certainly not after nvmm_machine_put when the vcpu could even be
 freed.

 PR kern/60544: nvmm_vcpu_run: use after mutex release


 To generate a diff of this commit:
 cvs rdiff -u -r1.48 -r1.49 src/sys/dev/nvmm/nvmm.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 08 Aug 2026 15:04:51 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10; inapplicable <10


>Unformatted:

Home	PR Database Search