From 64cf1d9f07d351974cef6220edd533b8adb2e3a3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 22 Sep 2025 07:50:28 +0200 Subject: [PATCH] 5.4-stable patches added patches: kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch net-rfkill-gpio-add-dt-support.patch net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch --- ...to-vmcb-v_tpr-even-if-avic-is-active.patch | 61 +++++++++++++++ .../net-rfkill-gpio-add-dt-support.patch | 77 +++++++++++++++++++ ...ereferencering-uninitialized-pointer.patch | 60 +++++++++++++++ queue-5.4/series | 3 + 4 files changed, 201 insertions(+) create mode 100644 queue-5.4/kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch create mode 100644 queue-5.4/net-rfkill-gpio-add-dt-support.patch create mode 100644 queue-5.4/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch diff --git a/queue-5.4/kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch b/queue-5.4/kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch new file mode 100644 index 0000000000..63d853cef1 --- /dev/null +++ b/queue-5.4/kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch @@ -0,0 +1,61 @@ +From stable+bounces-180859-greg=kroah.com@vger.kernel.org Mon Sep 22 02:07:46 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 20:07:39 -0400 +Subject: KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active +To: stable@vger.kernel.org +Cc: "Maciej S. Szmigiero" , "Naveen N Rao (AMD)" , Sean Christopherson , Sasha Levin +Message-ID: <20250922000739.3096059-1-sashal@kernel.org> + +From: "Maciej S. Szmigiero" + +[ Upstream commit d02e48830e3fce9701265f6c5a58d9bdaf906a76 ] + +Commit 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") +inhibited pre-VMRUN sync of TPR from LAPIC into VMCB::V_TPR in +sync_lapic_to_cr8() when AVIC is active. + +AVIC does automatically sync between these two fields, however it does +so only on explicit guest writes to one of these fields, not on a bare +VMRUN. + +This meant that when AVIC is enabled host changes to TPR in the LAPIC +state might not get automatically copied into the V_TPR field of VMCB. + +This is especially true when it is the userspace setting LAPIC state via +KVM_SET_LAPIC ioctl() since userspace does not have access to the guest +VMCB. + +Practice shows that it is the V_TPR that is actually used by the AVIC to +decide whether to issue pending interrupts to the CPU (not TPR in TASKPRI), +so any leftover value in V_TPR will cause serious interrupt delivery issues +in the guest when AVIC is enabled. + +Fix this issue by doing pre-VMRUN TPR sync from LAPIC into VMCB::V_TPR +even when AVIC is enabled. + +Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Reviewed-by: Naveen N Rao (AMD) +Link: https://lore.kernel.org/r/c231be64280b1461e854e1ce3595d70cde3a2e9d.1756139678.git.maciej.szmigiero@oracle.com +[sean: tag for stable@] +Signed-off-by: Sean Christopherson +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5580,8 +5580,7 @@ static inline void sync_lapic_to_cr8(str + struct vcpu_svm *svm = to_svm(vcpu); + u64 cr8; + +- if (svm_nested_virtualize_tpr(vcpu) || +- kvm_vcpu_apicv_active(vcpu)) ++ if (svm_nested_virtualize_tpr(vcpu)) + return; + + cr8 = kvm_get_cr8(vcpu); diff --git a/queue-5.4/net-rfkill-gpio-add-dt-support.patch b/queue-5.4/net-rfkill-gpio-add-dt-support.patch new file mode 100644 index 0000000000..753eef0e53 --- /dev/null +++ b/queue-5.4/net-rfkill-gpio-add-dt-support.patch @@ -0,0 +1,77 @@ +From stable+bounces-180857-greg=kroah.com@vger.kernel.org Mon Sep 22 02:06:48 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 20:06:36 -0400 +Subject: net: rfkill: gpio: add DT support +To: stable@vger.kernel.org +Cc: Philipp Zabel , Johannes Berg , Sasha Levin +Message-ID: <20250922000637.3095532-1-sashal@kernel.org> + +From: Philipp Zabel + +[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ] + +Allow probing rfkill-gpio via device tree. This hooks up the already +existing support that was started in commit 262c91ee5e52 ("net: +rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio" +compatible, with the "name" and "type" properties renamed to "label" +and "radio-type", respectively, in the device tree case. + +Signed-off-by: Philipp Zabel +Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de +Signed-off-by: Johannes Berg +Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rfkill/rfkill-gpio.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -79,6 +79,8 @@ static int rfkill_gpio_probe(struct plat + { + struct rfkill_gpio_data *rfkill; + struct gpio_desc *gpio; ++ const char *name_property; ++ const char *type_property; + const char *type_name; + int ret; + +@@ -86,8 +88,15 @@ static int rfkill_gpio_probe(struct plat + if (!rfkill) + return -ENOMEM; + +- device_property_read_string(&pdev->dev, "name", &rfkill->name); +- device_property_read_string(&pdev->dev, "type", &type_name); ++ if (dev_of_node(&pdev->dev)) { ++ name_property = "label"; ++ type_property = "radio-type"; ++ } else { ++ name_property = "name"; ++ type_property = "type"; ++ } ++ device_property_read_string(&pdev->dev, name_property, &rfkill->name); ++ device_property_read_string(&pdev->dev, type_property, &type_name); + + if (!rfkill->name) + rfkill->name = dev_name(&pdev->dev); +@@ -169,12 +178,19 @@ static const struct acpi_device_id rfkil + MODULE_DEVICE_TABLE(acpi, rfkill_acpi_match); + #endif + ++static const struct of_device_id rfkill_of_match[] __maybe_unused = { ++ { .compatible = "rfkill-gpio", }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, rfkill_of_match); ++ + static struct platform_driver rfkill_gpio_driver = { + .probe = rfkill_gpio_probe, + .remove = rfkill_gpio_remove, + .driver = { + .name = "rfkill_gpio", + .acpi_match_table = ACPI_PTR(rfkill_acpi_match), ++ .of_match_table = of_match_ptr(rfkill_of_match), + }, + }; + diff --git a/queue-5.4/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch b/queue-5.4/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch new file mode 100644 index 0000000000..6e68c7f023 --- /dev/null +++ b/queue-5.4/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch @@ -0,0 +1,60 @@ +From stable+bounces-180858-greg=kroah.com@vger.kernel.org Mon Sep 22 02:06:48 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 20:06:37 -0400 +Subject: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer +To: stable@vger.kernel.org +Cc: Hans de Goede , Heikki Krogerus , Johannes Berg , Sasha Levin +Message-ID: <20250922000637.3095532-2-sashal@kernel.org> + +From: Hans de Goede + +[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ] + +Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from +device property") rfkill_find_type() gets called with the possibly +uninitialized "const char *type_name;" local variable. + +On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" +acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: + + rfkill->type = (unsigned)id->driver_data; + +and there is no "type" property so device_property_read_string() will fail +and leave type_name uninitialized, leading to a potential crash. + +rfkill_find_type() does accept a NULL pointer, fix the potential crash +by initializing type_name to NULL. + +Note likely sofar this has not been caught because: + +1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device +2. The stack happened to contain NULL where type_name is stored + +Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Hans de Goede +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rfkill/rfkill-gpio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -78,10 +78,10 @@ static int rfkill_gpio_acpi_probe(struct + static int rfkill_gpio_probe(struct platform_device *pdev) + { + struct rfkill_gpio_data *rfkill; +- struct gpio_desc *gpio; ++ const char *type_name = NULL; + const char *name_property; + const char *type_property; +- const char *type_name; ++ struct gpio_desc *gpio; + int ret; + + rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL); diff --git a/queue-5.4/series b/queue-5.4/series index fc6d083712..739abd4e12 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -49,3 +49,6 @@ asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch usb-gadget-dummy_hcd-remove-usage-of-list-iterator-past-the-loop-body.patch usb-gadget-dummy-hcd-fix-locking-bug-in-rt-enabled-kernels.patch serial-sc16is7xx-fix-bug-in-flow-control-levels-init.patch +net-rfkill-gpio-add-dt-support.patch +net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch +kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch -- 2.47.3