kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
No description
1,232,073 commits 117 branches 5,805 tags 5.9 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Sean Christopherson 125da53b3c KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() 
commit 1e7381f361 upstream.

Explicitly verify the target vCPU is fully online _prior_ to clamping the
index in kvm_get_vcpu().  If the index is "bad", the nospec clamping will
generate '0', i.e. KVM will return vCPU0 instead of NULL.

In practice, the bug is unlikely to cause problems, as it will only come
into play if userspace or the guest is buggy or misbehaving, e.g. KVM may
send interrupts to vCPU0 instead of dropping them on the floor.

However, returning vCPU0 when it shouldn't exist per online_vcpus is
problematic now that KVM uses an xarray for the vCPUs array, as KVM needs
to insert into the xarray before publishing the vCPU to userspace (see
commit c5b0775491 ("KVM: Convert the kvm->vcpus array to a xarray")),
i.e. before vCPU creation is guaranteed to succeed.

As a result, incorrectly providing access to vCPU0 will trigger a
use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu()
bails out of vCPU creation due to an error and frees vCPU0.  Commit
afb2acb2e3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but
in doing so introduced an unsolvable teardown conundrum.  Preventing
accesses to vCPU0 before it's fully online will allow reverting commit
afb2acb2e3, without re-introducing the vcpu_array[0] UAF race.

Fixes: 1d487e9bf8 ("KVM: fix spectrev1 gadgets")
Cc: stable@vger.kernel.org
Cc: Will Deacon <will@kernel.org>
Cc: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20241009150455.1057573-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-17 09:40:16 +01:00
arch arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma 2025-02-17 09:40:16 +01:00
block partitions: ldm: remove the initial kernel-doc notation 2025-02-08 09:51:43 +01:00
certs certs: Reference revocation list for all keyrings 2023-08-17 20:12:41 +00:00
crypto crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes 2025-01-09 13:31:52 +01:00
Documentation dt-bindings: mfd: bd71815: Fix rsense and typos 2025-02-08 09:51:52 +01:00
drivers drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() 2025-02-17 09:40:16 +01:00
fs binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-02-17 09:40:16 +01:00
include KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() 2025-02-17 09:40:16 +01:00
init Compiler Attributes: disable __counted_by for clang < 19.1.3 2024-12-09 10:32:46 +01:00
io_uring io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock() 2025-02-08 09:52:33 +01:00
ipc ipc: fix memleak if msg_init_ns failed in create_ipc_ns 2024-12-09 10:32:54 +01:00
kernel printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX 2025-02-17 09:40:04 +01:00
lib lockdep: Fix upper limit for LOCKDEP_*_BITS configs 2025-02-17 09:40:03 +01:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm cachestat: fix page cache statistics permission checking 2025-02-01 18:37:54 +01:00
net rxrpc: Fix call state set to not include the SERVER_SECURING state 2025-02-17 09:40:14 +01:00
rust rust: macros: fix documentation of the paste! macro 2024-12-09 10:32:25 +01:00
samples samples/landlock: Fix possible NULL dereference in parse_path() 2025-02-08 09:51:57 +01:00
scripts kbuild: switch from lz4c to lz4 for compression 2025-02-08 09:52:35 +01:00
security tomoyo: don't emit warning in tomoyo_write_control() 2025-02-17 09:40:07 +01:00
sound ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx 2025-02-17 09:40:15 +01:00
tools udp: gso: do not drop small packets when PMTU reduces 2025-02-17 09:40:12 +01:00
usr initramfs: Encode dependency on KBUILD_BUILD_TIMESTAMP 2023-06-06 17:54:49 +09:00
virt KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock 2024-10-04 16:29:47 +02:00
.clang-format iommu: Add for_each_group_device() 2023-05-23 08:15:51 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-04 16:29:44 +02:00
.mailmap 20 hotfixes. 12 are cc:stable and the remainder address post-6.5 issues 2023-10-24 09:52:16 -10:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS USB: Remove Wireless USB and UWB documentation 2023-08-09 14:17:32 +02:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS membarrier: riscv: Add full memory barrier in switch_mm() 2024-09-12 11:11:45 +02:00
Makefile Linux 6.6.77 2025-02-11 09:37:33 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.