KVM x86 fixed for 7.3-rcN

Browse source

- If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
    table used by hardware to perform IPI Virtualization and delivered posted
    IRQs.  I.e. plug the same use-after-free hole related to IPI virtualization
    and posted IRQs that was fixed for APICv by commit b41f2ca6c0 ("KVM: VMX:
    Fix stale PID-pointer table entry left after vCPU free").
 
  - Use set_page_dirty_lock() instead of set_page_dirty() when marking a page
    dirty after writing back SNP firmware's desired CPUID state to userspace.
    Using set_page_dirty() is unsafe if the page/folio isn't locked (as pointed
    out by its function comment's big DANGER warning, which no one reads given
    the number of bugs of this exact nature).
 
  - When checking for an MMIO generation match, use the memslots for the current
    vCPU context (non-SMM vs. SMM), as a misbehaving guest can coerce KVM into
    incorrectly identifying a write as MMIO in order to bypass KVM's
    write-tracking.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmq/3aEACgkQOlYIJqCj
 N/0Qrg/+L64WbZWMUkLmW+8p3mDfk4gxn1HknzAN6EUQaHx+Qj4xjV++ydGDlBYt
 jfPFCpnotz0PihnWVCTzg0UsVLg4+8Ab2MIV1mrAxuurZNBSxAwESEpN6B0Glz8T
 0b7c5JC+4JuEVzaL+IYLjx3uV0Qo91cJiTF+N+aikLV0vESnLwc+s1pvZeIw+6Jf
 iV+tirgRAHhVXdcbAavoDyqqMCb7sGIkXB4rr6WYjmF90nFnE7xdtLDSvdJMsYxc
 HljehKhxuCujsZsgAbeRLx3Z1kz17cohS559sVPQgOTbmTv2CBE6jRRsodHVPRA7
 OfGYV40UMpQjyHDl0e19eFLdeSY9sTDa+GZkKhR2P7zo2f7Kwuhl9/hu5Jf8aFx0
 50vjpXZh7LSA5x3ftwOiKkZxfVCJOoB/YMSDw2WophNmsUHv1v932Y++57TdD9HH
 nvZsqyxZ16kZRMBESvkyeV50uvlBuZEMKyF2bq0+3UaodpcvemYlIXvFGEbZVxL9
 Ai424rwD1qbQhX6F8y94T+M8ZOLkd+1oecEWno3+MiqwXo43h2X2RmoNLk95fybi
 RkD5fbwGXqgW9pFt5awqqR2HPprrpCQvD22dU3QrWpzg0B042FhfcBe4lWinbk9x
 WssNn6javiuoHiuO9dZ5v4llI0H7wysyZuwgUV4joU15THfIBGQ=
 =EQ6H
 -----END PGP SIGNATURE-----

Merge tag 'kvm-x86-fixes-7.3-rc6' of https://github.com/kvm-x86/linux into HEAD

KVM x86 fixed for 7.3-rcN

 - If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
   table used by hardware to perform IPI Virtualization and delivered posted
   IRQs.  I.e. plug the same use-after-free hole related to IPI virtualization
   and posted IRQs that was fixed for APICv by commit b41f2ca6c0 ("KVM: VMX:
   Fix stale PID-pointer table entry left after vCPU free").

 - Use set_page_dirty_lock() instead of set_page_dirty() when marking a page
   dirty after writing back SNP firmware's desired CPUID state to userspace.
   Using set_page_dirty() is unsafe if the page/folio isn't locked (as pointed
   out by its function comment's big DANGER warning, which no one reads given
   the number of bugs of this exact nature).

 - When checking for an MMIO generation match, use the memslots for the current
   vCPU context (non-SMM vs. SMM), as a misbehaving guest can coerce KVM into
   incorrectly identifying a write as MMIO in order to bypass KVM's
   write-tracking.

...

This commit is contained in:

Paolo Bonzini 2026-10-09 17:49:26 +02:00

parent a90ee4305c b3e6212dea

commit bb44efdb08

5 changed files with 25 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

arch/x86/kvm/svm/avic.c

View file

2

arch/x86/kvm/svm/sev.c

View file

6

arch/x86/kvm/svm/svm.c

View file

1

arch/x86/kvm/svm/svm.h

View file

4

arch/x86/kvm/x86.h

View file