More x86 fixes:

Browse source

- Fix a WARN if the SS bit is set in #NPF exit codes; the AMD manual
   is unclear about whether it can be set when the guest uses CET but the
   SupervisorShadowStackEn feature (which KVM does not use) is disabled.
   However, Hyper-V has started using CET now that KVM supports GMET
   (it wants the two feature in pairs), and that dissolves all the doubts:
   the SS bit *is* reported and not clearing it causes a WARN and/or a
   UBSAN splat.
 
 - If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
   table used by hardware to perform IPI Virtualization and delivered posted
   IRQs.  I.e. plug the same use-after-free hole related to IPI virtualization
   and posted IRQs that was fixed for APICv by commit b41f2ca6c0 ("KVM: VMX:
   Fix stale PID-pointer table entry left after vCPU free").
 
 - Use set_page_dirty_lock() instead of set_page_dirty() when marking a page
   dirty after writing back SNP firmware's desired CPUID state to userspace.
   Using set_page_dirty() is unsafe if the page/folio isn't locked (as pointed
   out by its function comment's big DANGER warning, which no one reads given
   the number of bugs of this exact nature).
 
 - When checking for an MMIO generation match, use the memslots for the current
   vCPU context (non-SMM vs. SMM), as a misbehaving guest can coerce KVM into
   incorrectly identifying a write as MMIO in order to bypass KVM's
   write-tracking.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrNF30UHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroP+hQf/YEYOwFlxcG8vykALvjqseI/wJRXX
 lvJTrmu78az8mioeFNofc677Oyrbt52bZQOacVX+/csu0SvXfqpPZJ7A85eEjtax
 6deQoqa7Ktee2fjCpsA3hhOpixvwSidCuDf2UgZaV0XYbWoKJVt2KD0SjRUntxOp
 saGCspDgImIgZW1eVW3HPF8w4w5XpUGJvQysZcnoNJUMmRdUKsiP596Ds/VM1gyw
 hbYmG8yzle96mYFq12qGmUMrLh5HanYEr0vqNxcDcg/tc23xb5fHKuZS+RlhhtHO
 phc7+UnRAJWku9Xh+5EYHFwFW2umPmA57oxnBDIjmxxvMWrTv6h1z63MXg==
 =GByw
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "More x86 fixes:

   - Fix a WARN if the SS bit is set in #NPF exit codes.

     The AMD manual is unclear about whether it can be set when the
     guest uses CET but the SupervisorShadowStackEn feature (which KVM
     does not use) is disabled. However, Hyper-V has started using CET
     now that KVM supports GMET (it wants the two feature in pairs), and
     that dissolves all the doubts: the SS bit *is* reported and not
     clearing it causes a WARN and/or a UBSAN splat.

   - If creating a vCPU ultimately fails, clear its entry in the AVIC
     Physical ID table used by hardware to perform IPI Virtualization
     and delivered posted IRQs.

     I.e. plug the same use-after-free hole related to IPI
     virtualization and posted IRQs that was fixed for APICv by commit
     b41f2ca6c0 ("KVM: VMX: Fix stale PID-pointer table entry left
     after vCPU free").

   - Use set_page_dirty_lock() instead of set_page_dirty() when marking
     a page dirty after writing back SNP firmware's desired CPUID state
     to userspace.

     Using set_page_dirty() is unsafe if the page/folio isn't locked (as
     pointed out by its function comment's big DANGER warning, which no
     one reads given the number of bugs of this exact nature).

   - When checking for an MMIO generation match, use the memslots for
     the current vCPU context (non-SMM vs. SMM), as a misbehaving guest
     can coerce KVM into incorrectly identifying a write as MMIO in
     order to bypass KVM's write-tracking"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
  KVM: x86: Use active memslots for the per-vCPU MMIO cache
  KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
  KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
  KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
  KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable

...

This commit is contained in:

Linus Torvalds 2026-10-13 16:41:23 -07:00

parent 24a19b953e e90ab36691

commit 03741bcea0

7 changed files with 38 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

arch/x86/kvm/mmu.h

View file

3

arch/x86/kvm/mmu/paging_tmpl.h

View file

22

arch/x86/kvm/svm/avic.c

View file

2

arch/x86/kvm/svm/sev.c

View file

6

arch/x86/kvm/svm/svm.c

View file

1

arch/x86/kvm/svm/svm.h

View file

4

arch/x86/kvm/x86.h

View file