--- /dev/null
+From 3a07249981629ace483ebbef81ef6b34c2d2afec Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Sat, 27 Jun 2026 11:51:05 +0100
+Subject: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream.
+
+kvm_io_bus_get_dev() returns a device that is only matched by the
+address, and nothing else. This can cause a lifetime issue if
+the matched device is not the expected type, as by the time
+the caller can introspect the object, it might be gone (the srcu
+lock having been dropped).
+
+Given that there is only a single user of this helper, the simplest
+option is to move the locking responsibility to the caller, which
+can keep the srcu lock held for as long as it wants.
+
+Note that this aligns with other kvm_io_bus*() helpers, which
+already require the srcu lock to be held by the callers.
+
+Reported-by: Will Deacon <will@kernel.org>
+Fixes: 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call")
+Link: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org
+Cc: stable@vger.kernel.org
+Reviewed-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic-its.c | 15 +++++++++++----
+ virt/kvm/kvm_main.c | 16 +++++-----------
+ 2 files changed, 16 insertions(+), 15 deletions(-)
+
+--- a/arch/arm64/kvm/vgic/vgic-its.c
++++ b/arch/arm64/kvm/vgic/vgic-its.c
+@@ -704,6 +704,8 @@ struct vgic_its *vgic_msi_to_its(struct
+ u64 address;
+ struct kvm_io_device *kvm_io_dev;
+ struct vgic_io_device *iodev;
++ struct vgic_its *its = NULL;
++ int srcu_idx;
+
+ if (!vgic_has_its(kvm))
+ return ERR_PTR(-ENODEV);
+@@ -713,18 +715,23 @@ struct vgic_its *vgic_msi_to_its(struct
+
+ address = (u64)msi->address_hi << 32 | msi->address_lo;
+
++ srcu_idx = srcu_read_lock(&kvm->srcu);
++
+ kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address);
+ if (!kvm_io_dev)
+- return ERR_PTR(-EINVAL);
++ goto out;
+
+ if (kvm_io_dev->ops != &kvm_io_gic_ops)
+- return ERR_PTR(-EINVAL);
++ goto out;
+
+ iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
+ if (iodev->iodev_type != IODEV_ITS)
+- return ERR_PTR(-EINVAL);
++ goto out;
+
+- return iodev->its;
++ its = iodev->its;
++out:
++ srcu_read_unlock(&kvm->srcu, srcu_idx);
++ return its ?: ERR_PTR(-EINVAL);
+ }
+
+ /*
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -4558,25 +4558,19 @@ struct kvm_io_device *kvm_io_bus_get_dev
+ gpa_t addr)
+ {
+ struct kvm_io_bus *bus;
+- int dev_idx, srcu_idx;
+- struct kvm_io_device *iodev = NULL;
++ int dev_idx;
+
+- srcu_idx = srcu_read_lock(&kvm->srcu);
++ lockdep_assert_held(&kvm->srcu);
+
+ bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
+ if (!bus)
+- goto out_unlock;
++ return NULL;
+
+ dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
+ if (dev_idx < 0)
+- goto out_unlock;
++ return NULL;
+
+- iodev = bus->range[dev_idx].dev;
+-
+-out_unlock:
+- srcu_read_unlock(&kvm->srcu, srcu_idx);
+-
+- return iodev;
++ return bus->range[dev_idx].dev;
+ }
+ EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev);
+
--- /dev/null
+From 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f Mon Sep 17 00:00:00 2001
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+Date: Tue, 16 Jun 2026 19:20:17 +0800
+Subject: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
+
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+
+commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream.
+
+update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with
+
+ u64 nsecs = rlim_new * NSEC_PER_SEC;
+
+On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC
+(1000000000L) are 32-bit, so the multiplication is performed in unsigned
+long and truncated for rlim_new > 4 seconds before being widened to u64.
+
+The same file already casts to u64 for the matching computation in
+check_process_timers():
+
+ u64 softns = (u64)soft * NSEC_PER_SEC;
+
+As a result, the truncated value is installed into the CPUCLOCK_PROF
+expiry cache (nextevt), causing the process CPU timer to be programmed
+to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The
+actual SIGXCPU/SIGKILL decision in check_process_timers() already casts
+to u64 and is therefore correct, so limit enforcement is not broken;
+only the expiry-cache programming is wrong. Apply the same cast here so
+both paths convert rlim_cur identically.
+
+64-bit kernels are unaffected.
+
+Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec")
+Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/posix-cpu-timers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -37,7 +37,7 @@ void posix_cputimers_group_init(struct p
+ */
+ void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new)
+ {
+- u64 nsecs = rlim_new * NSEC_PER_SEC;
++ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC;
+
+ spin_lock_irq(&task->sighand->siglock);
+ set_process_cpu_timer(task, CPUCLOCK_PROF, &nsecs, NULL);
projects / thirdparty / kernel / stable-queue.git / commitdiff
