From: zengchi <zengchi@kylinos.cn>

kvm_init_debug() creates the "kvm" debugfs directory along with all of
the VM/vCPU stat files, but none of kvm_init()'s error paths removes it.
If kvm_vfio_ops_init(), kvm_gmem_init(), kvm_init_virtualization() or
misc_register() fails, the directory is leaked, and none of kvm_init()'s
callers invokes kvm_exit() on failure, i.e. nothing papers over the
leak.

The stale /sys/kernel/debug/kvm directory isn't just cosmetic: a
subsequent attempt to load KVM makes debugfs_create_dir() fail with
-EEXIST, after which kvm_debugfs_dir holds an ERR_PTR and all stat
files are silently never created again.  Worse, the leaked stat files
reference file_operations and stat data that live in the KVM module; if
the module is unloaded after the failed initialization, reading the
stale files is a use-after-free.

Remove the debugfs directory in the error path, mirroring kvm_exit().

Fixes: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
Cc: stable@vger.kernel.org
Signed-off-by: zengchi <zengchi@kylinos.cn>
---
 virt/kvm/kvm_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 45e784462ec6..8a503ac1adbd 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -6553,6 +6553,7 @@ int kvm_init(unsigned vcpu_size, unsigned vcpu_align, struct module *module)
 err_gmem:
 	kvm_vfio_ops_exit();
 err_vfio:
+	debugfs_remove_recursive(kvm_debugfs_dir);
 	kvm_async_pf_deinit();
 err_async_pf:
 	kvm_irqfd_exit();
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus

On Fri, Aug 07, 2026, Zeng Chi wrote:
> From: zengchi <zengchi@kylinos.cn>
> 
> kvm_init_debug() creates the "kvm" debugfs directory along with all of
> the VM/vCPU stat files, but none of kvm_init()'s error paths removes it.
> If kvm_vfio_ops_init(), kvm_gmem_init(), kvm_init_virtualization() or
> misc_register() fails, the directory is leaked, and none of kvm_init()'s
> callers invokes kvm_exit() on failure, i.e. nothing papers over the
> leak.
> 
> The stale /sys/kernel/debug/kvm directory isn't just cosmetic: a
> subsequent attempt to load KVM makes debugfs_create_dir() fail with
> -EEXIST, after which kvm_debugfs_dir holds an ERR_PTR and all stat
> files are silently never created again.  Worse, the leaked stat files
> reference file_operations and stat data that live in the KVM module; if
> the module is unloaded after the failed initialization, reading the
> stale files is a use-after-free.
> 
> Remove the debugfs directory in the error path, mirroring kvm_exit().
> 
> Fixes: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
> Cc: stable@vger.kernel.org
> Signed-off-by: zengchi <zengchi@kylinos.cn>
> ---
>  virt/kvm/kvm_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 45e784462ec6..8a503ac1adbd 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -6553,6 +6553,7 @@ int kvm_init(unsigned vcpu_size, unsigned vcpu_align, struct module *module)
>  err_gmem:
>  	kvm_vfio_ops_exit();
>  err_vfio:
> +	debugfs_remove_recursive(kvm_debugfs_dir);
>  	kvm_async_pf_deinit();
>  err_async_pf:
>  	kvm_irqfd_exit();
> -- 

Already posted (twice) and applied:

https://lore.kernel.org/all/20260706095910.39798-1-leixiang@kylinos.cn

> > 
> > The stale /sys/kernel/debug/kvm directory isn't just cosmetic: a
> > subsequent attempt to load KVM makes debugfs_create_dir() fail with
> > -EEXIST, after which kvm_debugfs_dir holds an ERR_PTR and all stat
> > files are silently never created again.  Worse, the leaked stat files
> > reference file_operations and stat data that live in the KVM module; if
> > the module is unloaded after the failed initialization, reading the
> > stale files is a use-after-free.
> > 
> > 

[...]

> 
> Already posted (twice) and applied:
> 
> https://lore.kernel.org/all/20260706095910.39798-1-leixiang@kylinos.cn

Do we need to "Cc: stable"?  The one in your tree (commit db3a46e200df2) doesn't
have that.

On Fri, Aug 07, 2026, Kai Huang wrote:
> > > 
> > > The stale /sys/kernel/debug/kvm directory isn't just cosmetic: a
> > > subsequent attempt to load KVM makes debugfs_create_dir() fail with
> > > -EEXIST, after which kvm_debugfs_dir holds an ERR_PTR and all stat
> > > files are silently never created again.  Worse, the leaked stat files
> > > reference file_operations and stat data that live in the KVM module; if
> > > the module is unloaded after the failed initialization, reading the
> > > stale files is a use-after-free.
> > > 
> > > 
> 
> [...]
> 
> > 
> > Already posted (twice) and applied:
> > 
> > https://lore.kernel.org/all/20260706095910.39798-1-leixiang@kylinos.cn
> 
> Do we need to "Cc: stable"?  The one in your tree (commit db3a46e200df2) doesn't
> have that.

I was thinking "no", as I don't think it's likely to be problematic outside of
fuzzers and error injection, but I also wouldn't object if someone feels strongly
that it should be sent to LTS kernels.