From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:16:02 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a950affc481f68fc94d9294ff9420da6330e1793;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch --- diff --git a/queue-5.10/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch b/queue-5.10/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch new file mode 100644 index 0000000000..71d9112b96 --- /dev/null +++ b/queue-5.10/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch @@ -0,0 +1,107 @@ +From 3a07249981629ace483ebbef81ef6b34c2d2afec Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sat, 27 Jun 2026 11:51:05 +0100 +Subject: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers + +From: Marc Zyngier + +commit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream. + +kvm_io_bus_get_dev() returns a device that is only matched by the +address, and nothing else. This can cause a lifetime issue if +the matched device is not the expected type, as by the time +the caller can introspect the object, it might be gone (the srcu +lock having been dropped). + +Given that there is only a single user of this helper, the simplest +option is to move the locking responsibility to the caller, which +can keep the srcu lock held for as long as it wants. + +Note that this aligns with other kvm_io_bus*() helpers, which +already require the srcu lock to be held by the callers. + +Reported-by: Will Deacon +Fixes: 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call") +Link: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org +Cc: stable@vger.kernel.org +Reviewed-by: Oliver Upton +Link: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/vgic/vgic-its.c | 15 +++++++++++---- + virt/kvm/kvm_main.c | 16 +++++----------- + 2 files changed, 16 insertions(+), 15 deletions(-) + +--- a/arch/arm64/kvm/vgic/vgic-its.c ++++ b/arch/arm64/kvm/vgic/vgic-its.c +@@ -704,6 +704,8 @@ struct vgic_its *vgic_msi_to_its(struct + u64 address; + struct kvm_io_device *kvm_io_dev; + struct vgic_io_device *iodev; ++ struct vgic_its *its = NULL; ++ int srcu_idx; + + if (!vgic_has_its(kvm)) + return ERR_PTR(-ENODEV); +@@ -713,18 +715,23 @@ struct vgic_its *vgic_msi_to_its(struct + + address = (u64)msi->address_hi << 32 | msi->address_lo; + ++ srcu_idx = srcu_read_lock(&kvm->srcu); ++ + kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address); + if (!kvm_io_dev) +- return ERR_PTR(-EINVAL); ++ goto out; + + if (kvm_io_dev->ops != &kvm_io_gic_ops) +- return ERR_PTR(-EINVAL); ++ goto out; + + iodev = container_of(kvm_io_dev, struct vgic_io_device, dev); + if (iodev->iodev_type != IODEV_ITS) +- return ERR_PTR(-EINVAL); ++ goto out; + +- return iodev->its; ++ its = iodev->its; ++out: ++ srcu_read_unlock(&kvm->srcu, srcu_idx); ++ return its ?: ERR_PTR(-EINVAL); + } + + /* +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -4558,25 +4558,19 @@ struct kvm_io_device *kvm_io_bus_get_dev + gpa_t addr) + { + struct kvm_io_bus *bus; +- int dev_idx, srcu_idx; +- struct kvm_io_device *iodev = NULL; ++ int dev_idx; + +- srcu_idx = srcu_read_lock(&kvm->srcu); ++ lockdep_assert_held(&kvm->srcu); + + bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu); + if (!bus) +- goto out_unlock; ++ return NULL; + + dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1); + if (dev_idx < 0) +- goto out_unlock; ++ return NULL; + +- iodev = bus->range[dev_idx].dev; +- +-out_unlock: +- srcu_read_unlock(&kvm->srcu, srcu_idx); +- +- return iodev; ++ return bus->range[dev_idx].dev; + } + EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev); + diff --git a/queue-5.10/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch b/queue-5.10/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch new file mode 100644 index 0000000000..0ffedccb62 --- /dev/null +++ b/queue-5.10/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch @@ -0,0 +1,53 @@ +From 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f Mon Sep 17 00:00:00 2001 +From: Zhan Xusheng +Date: Tue, 16 Jun 2026 19:20:17 +0800 +Subject: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() + +From: Zhan Xusheng + +commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream. + +update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with + + u64 nsecs = rlim_new * NSEC_PER_SEC; + +On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC +(1000000000L) are 32-bit, so the multiplication is performed in unsigned +long and truncated for rlim_new > 4 seconds before being widened to u64. + +The same file already casts to u64 for the matching computation in +check_process_timers(): + + u64 softns = (u64)soft * NSEC_PER_SEC; + +As a result, the truncated value is installed into the CPUCLOCK_PROF +expiry cache (nextevt), causing the process CPU timer to be programmed +to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The +actual SIGXCPU/SIGKILL decision in check_process_timers() already casts +to u64 and is therefore correct, so limit enforcement is not broken; +only the expiry-cache programming is wrong. Apply the same cast here so +both paths convert rlim_cur identically. + +64-bit kernels are unaffected. + +Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec") +Signed-off-by: Zhan Xusheng +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/posix-cpu-timers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -37,7 +37,7 @@ void posix_cputimers_group_init(struct p + */ + void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new) + { +- u64 nsecs = rlim_new * NSEC_PER_SEC; ++ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC; + + spin_lock_irq(&task->sighand->siglock); + set_process_cpu_timer(task, CPUCLOCK_PROF, &nsecs, NULL); diff --git a/queue-5.10/series b/queue-5.10/series index 47b26c7a6c..dcb480c5a4 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -682,3 +682,5 @@ crypto-qat-fix-restarting-state-leak-on-allocation-failure.patch crypto-qat-validate-rsa-crt-component-lengths.patch audit-add-audit_log_nf_skb-helper-function.patch audit-fix-potential-integer-overflow-in-audit_log_n_hex.patch +posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch +kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch