Sean Christopherson
5cce2ed69b
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() ...
commit 1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 upstream.
Explicitly verify the target vCPU is fully online _prior_ to clamping the
index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will
generate '0', i.e. KVM will return vCPU0 instead of NULL.
In practice, the bug is unlikely to cause problems, as it will only come
into play if userspace or the guest is buggy or misbehaving, e.g. KVM may
send interrupts to vCPU0 instead of dropping them on the floor.
However, returning vCPU0 when it shouldn't exist per online_vcpus is
problematic now that KVM uses an xarray for the vCPUs array, as KVM needs
to insert into the xarray before publishing the vCPU to userspace (see
commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")),
i.e. before vCPU creation is guaranteed to succeed.
As a result, incorrectly providing access to vCPU0 will trigger a
use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu()
bails out of vCPU creation due to an error and frees vCPU0. Commit
afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but
in doing so introduced an unsolvable teardown conundrum. Preventing
accesses to vCPU0 before it's fully online will allow reverting commit
afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race.
Fixes: 1d487e9bf8stable@vger.kernel.org
Cc: Will Deacon <will@kernel.org>
Cc: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20241009150455.1057573-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-13 12:43:07 +01:00
can: sja1000: fix size of OCR_MODE_MASK define
2022-12-19 12:24:16 +01:00
firmware: meson_sm: Rework driver as a proper platform driver
2024-04-13 12:51:26 +02:00
iio: st_sensors: Add a local lock for protecting odr
2022-06-14 18:11:59 +02:00
mailbox: zynqmp: Fix typo in IPI documentation
2023-05-17 11:35:55 +02:00
net: xgene: Move shared header file into include/linux
2023-02-06 07:52:47 +01:00
mfd: t7l66xb: Drop platform disable callback
2022-08-25 11:18:04 +02:00
RDMA/mlx5: Enforce same type port association for multiport RoCE
2025-01-09 13:23:34 +01:00
mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
2023-12-13 18:18:15 +01:00
mtd: rawnand: protect access to rawnand devices while in suspend
2024-11-17 14:58:51 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
2024-08-19 05:33:42 +02:00
power: supply: bq27xxx: Fix poll_interval handling and races on remove
2023-05-30 12:44:10 +01:00
qed: Improve the stack space of filter_config()
2024-08-19 05:33:30 +02:00
kernel/fork: beware of __put_task_struct() calling context
2023-09-23 11:00:03 +02:00
firmware: ti_sci: Replace HTTP links with HTTPS ones
2023-11-20 10:30:12 +01:00
spi: Fix deadlock when adding SPI controllers on SPI buses
2024-11-17 14:58:51 +01:00
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
2024-12-14 19:44:42 +01:00
usb: xhci: Add timeout argument in address_device USB HCD callback
2025-03-13 12:43:05 +01:00
ACPI/IORT: Make iort_msi_map_rid() PCI agnostic
2023-12-13 18:18:10 +01:00
arm64: entry: Add vectors that have the bhb mitigation sequences
2022-03-19 13:40:15 +01:00
ata: fix ata_id_has_dipm()
2022-10-26 13:22:39 +02:00
bitfield.h: Fix "type of reg too small for mask" test
2022-07-29 17:14:18 +02:00
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
2024-09-04 13:14:50 +02:00
ocfs2/dlm: move BITS_TO_BYTES() to bitops.h for wider use
2023-06-09 10:28:54 +02:00
block: don't merge across cgroup boundaries if blkcg is enabled
2022-04-15 14:18:01 +02:00
block: return unsigned int from bdev_io_min
2024-12-14 19:44:41 +01:00
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
2024-02-23 08:24:57 +01:00
fs: only do a memory barrier for the first set_buffer_uptodate()
2022-09-15 12:04:49 +02:00
cgroup: Move rcu_head up near the top of cgroup_root
2024-12-14 19:44:35 +01:00
memcg: fix possible use-after-free in memcg_write_event_control()
2022-12-14 11:30:43 +01:00
clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
2023-08-30 16:27:27 +02:00
ftruncate: pass a signed offset
2024-07-05 09:08:31 +02:00
Fix gcc 4.9 build issue in 5.4.y
2024-08-19 05:33:53 +02:00
init: Provide arch_cpu_finalize_init()
2023-08-08 19:56:33 +02:00
hrtimers: Push pending hrtimers away from outgoing CPU earlier
2023-12-13 18:18:09 +01:00
bitmap: introduce generic optimized bitmap_size()
2024-09-04 13:14:50 +02:00
cred: switch to using atomic_long_t
2023-12-20 15:41:18 +01:00
debugfs: regset32: Add Runtime PM support
2023-05-17 11:35:32 +02:00
PM/devfreq: governor: Add a private governor_data for governor
2023-01-18 11:41:52 +01:00
dm mpath: pass IO start time to path selector
2024-09-04 13:14:58 +02:00
driver: platform: Add helper for safer setting of driver_override
2023-11-08 11:23:39 +01:00
linux/dim: Do nothing if no time delta between samples
2023-05-30 12:44:01 +01:00
dma-mapping: add generic helpers for mapping sgtable objects
2023-02-25 11:53:25 +01:00
dma-mapping: drop the dev argument to arch_sync_dma_for_*
2023-04-05 11:16:43 +02:00
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
2024-02-23 08:25:06 +01:00
dyndbg: fix module.dyndbg handling
2022-10-26 13:22:37 +02:00
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
2024-12-14 19:44:55 +01:00
efi: random: reduce seed size to 32 bytes
2022-11-10 17:57:55 +01:00
ethernet: Add helper for assigning packet type when dest address does not match device address
2024-05-02 16:18:36 +02:00
eventfd: Export eventfd_ctx_do_read()
2023-09-23 10:59:40 +02:00
fbcon: Prevent that screen size is smaller than font size
2022-07-12 16:30:47 +02:00
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
2024-03-26 18:22:15 -04:00
objtool: Add support for intra-function calls
2024-04-13 12:51:29 +02:00
mount: warn only once about timestamp range expiration
2024-11-08 16:20:26 +01:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
fsnotify: Do not generate events for O_PATH file descriptors
2024-07-18 11:40:51 +02:00
ftrace: Mark get_lock_parent_ip() __always_inline
2023-04-20 12:07:34 +02:00
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
2024-04-13 12:51:34 +02:00
HID: fix HID device resource race between HID core and debugging support
2023-12-08 08:44:23 +01:00
mm/highmem: Lift memcpy_[to|from]_page to core
2023-01-18 11:41:55 +01:00
gpu: host1x: mipi: Update tegra_mipi_request() to be node based
2024-03-26 18:22:18 -04:00
hrtimers: Handle CPU state correctly on hotplug
2025-02-01 18:18:51 +01:00
hugetlb: check for undefined shift on 32 bit architectures
2023-02-22 12:50:39 +01:00
random: pull add_hwgenerator_randomness() declaration into random.h
2022-06-22 14:11:12 +02:00
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
2025-01-09 13:23:33 +01:00
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
2024-09-12 11:03:50 +02:00
Fix termination state for idr_for_each_entry_ul()
2023-11-20 10:30:15 +01:00
net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
2023-09-23 10:59:55 +02:00
team: fix null-ptr-deref when team device type is changed
2023-10-10 21:46:37 +02:00
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
2025-01-09 13:23:35 +01:00
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
2023-03-11 16:44:02 +01:00
interconnect: Add helpers for enabling/disabling a path
2023-08-30 16:27:13 +02:00
tasklet: Introduce new initialization API
2025-03-13 12:43:04 +01:00
iomap: iomap that extends beyond EOF should be marked dirty
2022-09-28 11:03:58 +02:00
iommu: Return right value in iommu_sva_bind_device()
2024-07-05 09:08:16 +02:00
resource: Add irqresource_disabled()
2023-10-25 11:53:22 +02:00
iommu/iova: Fix module config properly
2022-10-26 13:22:46 +02:00
shm: extend forced shm destroy to support objects from several IPC nses
2021-12-01 09:23:35 +01:00
ipv6: make mc_forwarding atomic
2022-04-15 14:18:32 +02:00
genirq: Allow irq_chip registration functions to take a const irq_chip
2024-08-19 05:33:45 +02:00
genirq: Allow the PM device to originate from irq domain
2024-08-19 05:33:43 +02:00
jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
2024-11-08 16:20:30 +01:00
time: Fix references to _msecs_to_jiffies() handling of values
2024-12-14 19:44:23 +01:00
module: Extend the preempt disabled section in dereference_symbol_descriptor().
2025-03-13 12:42:59 +01:00
panic: Consolidate open-coded panic_on_warn checks
2023-02-06 07:52:50 +01:00
genirq: Fix the return type of kstat_cpu_irqs_sum()
2023-03-11 16:43:38 +01:00
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:28:50 +02:00
kfifo: fix kfifo_to_user() return type
2022-08-25 11:18:04 +02:00
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
2023-03-11 16:44:02 +01:00
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
2025-03-13 12:43:07 +01:00
leds: class: Protect brightness_show() with led_cdev->led_access mutex
2024-12-14 19:44:53 +01:00
ata: libata-sata: increase PMP SRST timeout to 10s
2023-10-10 21:46:42 +02:00
list: add "list_del_init_careful()" to go with "list_empty_careful()"
2023-06-28 10:18:35 +02:00
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
2024-03-01 13:13:38 +01:00
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
mailbox: forward the hrtimer if not queued and under a lock
2022-06-14 18:11:42 +02:00
ext4: fix deadlock due to mbcache entry corruption
2023-01-18 11:41:56 +01:00
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
2022-05-25 09:14:32 +02:00
mcb: remove is_added flag from mcb_device struct
2023-10-25 11:53:19 +02:00
memblock: fix memblock_phys_alloc() section mismatch error
2022-01-05 12:37:44 +01:00
net: phy: mchp: Add support for LAN8814 QUAD PHY
2024-07-05 09:08:27 +02:00
mm: add remap_pfn_range_notrack
2024-11-17 14:58:53 +01:00
mm: fix ambiguous comments for better code readability
2024-11-17 14:58:53 +01:00
mmap locking API: initial implementation as rwsem wrappers
2022-07-29 17:14:18 +02:00
mm: Fix '.data.once' orphan section warning
2022-12-08 11:23:04 +01:00
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
2022-05-15 19:54:46 +02:00
x86/cpu: Add a steppings field to struct x86_cpu_id
2022-10-07 09:16:54 +02:00
params: lift param_set_uint_minmax to common code
2024-06-16 13:28:45 +02:00
new helper: lookup_positive_unlocked()
2023-09-23 10:59:40 +02:00
net: Fix features skip in for_each_netdev_feature()
2022-05-18 09:47:24 +02:00
net: add DEV_STATS_READ() helper
2023-11-20 10:30:10 +01:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
2024-12-14 19:44:28 +01:00
NFS: swap IO handling is slightly different for O_DIRECT IO
2022-04-15 14:18:35 +02:00
fs/nls: make load_nls() take a const parameter
2023-09-23 10:59:38 +02:00
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
2023-07-27 08:37:10 +02:00
nodemask: Fix return values to be unsigned
2022-06-14 18:12:02 +02:00
uaccess: Add speculation barrier to copy_from_user()
2023-02-25 11:53:26 +01:00
nvme-tcp: fix nvme_tcp_term_pdu to match spec
2023-04-05 11:16:38 +02:00
nvme: fixup comment for nvme RDMA Provider Type
2024-07-05 09:08:28 +02:00
mlxsw: spectrum_acl_erp: Fix object nesting warning
2024-08-19 05:33:28 +02:00
of: Add missing 'Return' section in kerneldoc comments
2023-12-13 18:18:11 +01:00
of: clk: Make <linux/of_clk.h> self-contained
2021-12-08 09:01:08 +01:00
of/irq: Make of_msi_map_rid() PCI bus agnostic
2023-12-13 18:18:11 +01:00
once: fix section mismatch on clang builds
2022-11-01 19:06:42 +01:00
overflow: Allow mixed type arguments
2025-03-13 12:42:52 +01:00
PCI: Add PCI_ERROR_RESPONSE and related definitions
2024-07-05 09:08:25 +02:00
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
2024-11-08 16:20:47 +01:00
perf/core: Add a new read format to get a number of lost samples
2023-12-13 18:18:15 +01:00
driver: platform: Add helper for safer setting of driver_override
2023-11-08 11:23:39 +01:00
PM: domains: Restore comment indentation for generic_pm_domain.child_links
2023-05-17 11:36:04 +02:00
PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
2024-02-23 08:25:14 +01:00
PM / wakeirq: support enabling wake-up irq after runtime_suspend called
2023-08-11 11:54:00 +02:00
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
2025-02-01 18:18:51 +01:00
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
2023-06-05 08:17:31 +02:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
sched/rt: Provide migrate_disable/enable() inlines
2023-11-20 10:30:12 +01:00
printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
2023-05-17 11:36:04 +02:00
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
2023-01-18 11:41:02 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
2022-06-14 18:11:24 +02:00
pwm: Fix double shift bug
2023-11-28 16:50:16 +00:00
quota: Fix slow quotaoff
2023-10-25 11:53:18 +02:00
quota: Fix slow quotaoff
2023-10-25 11:53:18 +02:00
scsi: core: raid_class: Remove raid_component_add()
2023-08-30 16:27:27 +02:00
random: always mix cycle counter in add_latent_entropy()
2023-02-25 11:53:25 +01:00
random: quiet urandom warning ratelimit suppression message
2022-06-29 08:58:45 +02:00
rcu: add a helper to report consolidated flavor QS
2024-03-26 18:22:25 -04:00
locking/refcount: Consolidate implementations of refcount_t
2022-07-29 17:14:17 +02:00
regmap: Add bulk read/write callbacks into regmap_config
2024-03-15 10:48:20 -04:00
ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance()
2024-09-12 11:03:56 +02:00
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
2022-09-05 10:27:46 +02:00
rpmsg: Fix calling device_lock() on non-initialized device
2023-11-08 11:23:39 +01:00
misc: rtsx_usb: use separate command and response buffers
2022-07-12 16:30:49 +02:00
scatterlist: add generic wrappers for iterating over sgtable objects
2023-02-25 11:53:25 +01:00
kernel/sched: Remove dl_boosted flag comment
2022-09-05 10:27:39 +02:00
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
Revert "8250: add support for ASIX devices with a FIFO bug"
2023-07-27 08:37:38 +02:00
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
2024-05-02 16:18:37 +02:00
sh: intc: Avoid spurious sizeof-pointer-div warning
2023-03-22 13:28:08 +01:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
skbuff: introduce skb_expand_head()
2025-01-09 13:23:32 +01:00
net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
2023-02-22 12:50:34 +01:00
lib/string_helpers: Introduce string_upper() and string_lower() helpers
2023-05-30 12:44:08 +01:00
PM: s2idle: ACPI: Fix wakeup interrupts handling
2022-02-16 12:52:50 +01:00
ftruncate: pass a signed offset
2024-07-05 09:08:31 +02:00
sysctl: add a new register_sysctl_init() interface
2023-02-06 07:52:48 +01:00
tcp: add TCP_INFO status for failed client TFO
2024-07-18 11:40:53 +02:00
tee: export teedev_open() and teedev_close_context()
2022-03-02 11:41:04 +01:00
tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
2023-05-17 11:35:57 +02:00
timers: Rename del_timer_sync() to timer_delete_sync()
2024-04-13 12:51:21 +02:00
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
2023-01-18 11:40:53 +01:00
timekeeping: Add raw clock fallback for random_get_entropy()
2022-06-22 14:11:15 +02:00
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
2022-03-08 19:07:48 +01:00
efi: tpm: Avoid READ_ONCE() for accessing the event log
2023-01-18 11:42:00 +01:00
tracing: Constify string literal data member in struct trace_event_call
2025-01-09 13:23:33 +01:00
tracing: Make tracepoint lockdep check actually test something
2023-03-22 13:28:08 +01:00
tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
2023-05-17 11:36:04 +02:00
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
2022-07-29 17:14:20 +02:00
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
2024-05-02 16:18:28 +02:00
uaccess: Add minimum bounds check on kernel buffer size
2023-03-11 16:43:56 +01:00
units: add the HZ macros
2024-02-23 08:24:47 +01:00
xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
2025-02-01 18:18:54 +01:00
util_macros.h: fix/rework find_closest() macros
2024-12-14 19:44:43 +01:00
vfio: Introduce interface to flush virqfd inject workqueue
2024-04-13 12:51:34 +02:00
virtio: unexport virtio_finalize_features
2022-03-16 13:21:48 +01:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
net: do not allow gso_size to be set to GSO_BY_FRAGS
2023-08-30 16:27:17 +02:00
linux/vt_buffer.h: allow either builtin or modular for macros
2023-05-17 11:35:46 +02:00
epoll: Add synchronous wakeup support for ep_poll_callback
2025-01-09 13:23:32 +01:00
workqueue: clean up WORK_* constant types, clarify masking
2023-07-27 08:37:29 +02:00
