kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity

Final KVM fixes for 6.19:

Browse source 
- Fix a bug where AVIC is incorrectly inhibited when running with x2AVIC
    disabled via module param (or on a system without x2AVIC).
 
  - Fix a dangling device posted IRQs bug by explicitly checking if the irqfd is
    still active (on the list) when handling an eventfd signal, instead of
    zeroing the irqfd's routing information when the irqfd is deassigned.
    Zeroing the irqfd's routing info causes arm64 and x86's to not disable
    posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks for an MSI),
    incorrectly leaving the IRQ in posted mode (and leading to use-after-free
    and memory leaks on AMD in particular).
 
    This is both the most pressing and scariest, but it's been in -next for
    a while.
 
  - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from
    generating calls to the checked versions of memset() and friends, which
    leads to unexpected page faults in guest code due e.g. __memset_chk@plt
    not being resolved.
 
  - Explicitly configure the support XSS from within {svm,vmx}_set_cpu_caps() to
    fix a bug where VMX will compute the reference VMCS configuration with SHSTK
    and IBT enabled, but then compute each CPUs local config with SHSTK and IBT
    disabled if not all CET xfeatures are enabled, e.g. if the kernel is built
    with X86_KERNEL_IBT=n.  The mismatch in features results in differing nVMX
    setting, and ultimately causes kvm-intel.ko to refuse to load with nested=1.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmmDgqcUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroOnPggArLZiVQjG3crGcV9rePwo8Wzwilj8
 RgMNPARW6OlKRVSNJTvxvUdQ3G9plrnq0EuvezF27YnNJoptu6XsyaIlGX7wQaEq
 Krw5agrbx/8FzH6kvXuE5jD8PwNVKwstML+uN1T+NSBncE88IiZxH0Fp0E2LnBxP
 VCeR4NTQeLdXk15O2c3lQ5s9SN0vHeUNKy53myjU1AodwjsQ40BQjwd0z7d8NbYu
 1gyH7wMmRvJG39KMVSaQgVwG7WA6HvrKKnydLWG5tVdUA0U7wiUHrFwIprXK/TNG
 hSuPpI/pmCI1kdRRRgip+Z7yIWmZt5MnaRDADnZ3nA8+bznl5Uo6kvLROQ==
 =CYK3
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull KVM fixes from Paolo Bonzini:

 - Fix a bug where AVIC is incorrectly inhibited when running with
   x2AVIC disabled via module param (or on a system without x2AVIC)

 - Fix a dangling device posted IRQs bug by explicitly checking if the
   irqfd is still active (on the list) when handling an eventfd signal,
   instead of zeroing the irqfd's routing information when the irqfd is
   deassigned.

   Zeroing the irqfd's routing info causes arm64 and x86's to not
   disable posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks
   for an MSI), incorrectly leaving the IRQ in posted mode (and leading
   to use-after-free and memory leaks on AMD in particular).

   This is both the most pressing and scariest, but it's been in -next
   for a while.

 - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from
   generating calls to the checked versions of memset() and friends,
   which leads to unexpected page faults in guest code due e.g.
   __memset_chk@plt not being resolved.

 - Explicitly configure the supported XSS capabilities from within
   {svm,vmx}_set_cpu_caps() to fix a bug where VMX will compute the
   reference VMCS configuration with SHSTK and IBT enabled, but then
   compute each CPUs local config with SHSTK and IBT disabled if not all
   CET xfeatures are enabled, e.g. if the kernel is built with
   X86_KERNEL_IBT=n.

   The mismatch in features results in differing nVMX setting, and
   ultimately causes kvm-intel.ko to refuse to load with nested=1.

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()
  KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures
  KVM: x86: Assert that non-MSI doesn't have bypass vCPU when deleting producer
  KVM: Don't clobber irqfd routing type when deassigning irqfd
  KVM: SVM: Check vCPU ID against max x2AVIC ID if and only if x2AVIC is enabled
This commit is contained in:
Linus Torvalds 2026-02-04 10:38:56 -08:00
commit 27db1ae6ec
8 changed files with 52 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files