KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails

Browse source

If vCPU creation fails after kvm_arch_vcpu_create(), the AVIC Physical
ID table entry corresponding to that vCPU continues to point to the
freed APIC backing page which can result in UAF. Address this by
clearing out the corresponding AVIC Physical ID table entry in the
vcpu_free() callback, similar to the VMX commit b41f2ca6c0 ("KVM: VMX:
Fix stale PID-pointer table entry left after vCPU free").

Though unlikely, it is also possible that svm_vcpu_create() itself fails
after the AVIC Physical ID table entry has been setup if memory
allocation fails in svm_vcpu_alloc_msrpm(). Clear the entry in this path
as well.

Note: this change depends on commit 97d65b544f ("KVM: Check for
duplicate vcpu_id as early as possible"), which ensures that a vCPU with
a duplicate ID is never created. Otherwise, a valid AVIC Physical ID
table entry for an existing vCPU will be cleared.

Fixes: 44a95dae1d ("KVM: x86: Detect and Initialize AVIC support")
Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org>
Tested-by: Atish Patra <atishp@meta.com>
[sean: use avic_is_addressable_vcpu()]
Link: https://patch.msgid.link/20260923155108.1550622-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

...

This commit is contained in:

Naveen N Rao (AMD) 2026-09-23 08:51:08 -07:00 • committed by Sean Christopherson

parent 12e0d427c3

commit 88c15bbd43

3 changed files with 14 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

arch/x86/kvm/svm/avic.c

View file

6

arch/x86/kvm/svm/svm.c

View file

1

arch/x86/kvm/svm/svm.h

View file