5.10-stable patches

added patches:
	kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
	udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch

diff --git a/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch b/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
new file mode 100644 (file)
index 0000000..1d799d0
--- /dev/null
+++ b/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
@@ -0,0 +1,66 @@
+From 7ef78d71ca713d8c00f7c34ddcf276c808143f77 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Thu, 18 Jun 2026 10:43:46 -0700
+Subject: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream.
+
+When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
+guest mode so that a future change can have update CR8 intercepts during
+vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
+
+  ------------[ cut here ]------------
+  debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
+  WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
+  WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
+  Modules linked in:
+  CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
+  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
+  RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
+  RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
+  Call Trace:
+   <TASK>
+   apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
+   kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
+   kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
+   kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
+   kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
+   kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
+   vfs_ioctl fs/ioctl.c:51 [inline]
+   __do_sys_ioctl fs/ioctl.c:597 [inline]
+   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
+   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+   do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
+   entry_SYSCALL_64_after_hwframe+0x77/0x7f
+   </TASK>
+
+No functional change intended.
+
+Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
+Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20260618174347.1981064-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx/vmx.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -6309,11 +6309,10 @@ static noinstr void vmx_l1d_flush(struct
+ 
+ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+ {
+-      struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+       int tpr_threshold;
+ 
+       if (is_guest_mode(vcpu) &&
+-              nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++          nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW))
+               return;
+ 
+       tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;

diff --git a/queue-5.10/series b/queue-5.10/series
index f7c960eb54e18448e83f44304eed67d83d416402..e63d84a2ea96b83bd663a08f8016a5c8929887f2 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -138,3 +138,5 @@ spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch
 tracing-prevent-out-of-bounds-read-in-glob-matching.patch
 nfsv4-include-may_write-in-open-permission-mask-for-o_trunc.patch
 exfat-bound-uniname-advance-in-exfat_find_dir_entry.patch
+kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
+udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch

diff --git a/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch b/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch
new file mode 100644 (file)
index 0000000..e540d25
--- /dev/null
+++ b/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch
@@ -0,0 +1,70 @@
+From fb7b1a0ab25a6077d26cb3829e31743972d4f31d Mon Sep 17 00:00:00 2001
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Date: Sun, 15 Mar 2026 04:27:22 +0500
+Subject: udmabuf: fix DMA direction mismatch in release_udmabuf()
+
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+
+commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream.
+
+begin_cpu_udmabuf() maps the sg_table with the caller-provided direction
+(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg
+for reuse.  However, release_udmabuf() always unmaps this sg_table with
+a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was
+originally used for the mapping.
+
+With CONFIG_DMA_API_DEBUG=y this produces:
+
+  DMA-API: misc udmabuf: device driver frees DMA memory with different
+  direction [device address=0x000000044a123000] [size=4096 bytes]
+  [mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL]
+
+The issue was found during video playback when GStreamer performed a
+write-only DMA_BUF_IOCTL_SYNC on a udmabuf.  It can be reproduced
+with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd,
+performing a write-only sync (DMA_BUF_SYNC_WRITE without
+DMA_BUF_SYNC_READ), and closing the file descriptor.
+
+Fix this by storing the DMA direction used when the sg_table is first
+created in begin_cpu_udmabuf(), and passing that same direction to
+put_sg_table() in release_udmabuf().
+
+Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma-buf/udmabuf.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -19,6 +19,7 @@ struct udmabuf {
+       pgoff_t pagecount;
+       struct page **pages;
+       struct sg_table *sg;
++      enum dma_data_direction sg_dir;
+       struct miscdevice *device;
+ };
+ 
+@@ -105,7 +106,7 @@ static void release_udmabuf(struct dma_b
+       pgoff_t pg;
+ 
+       if (ubuf->sg)
+-              put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
++              put_sg_table(dev, ubuf->sg, ubuf->sg_dir);
+ 
+       for (pg = 0; pg < ubuf->pagecount; pg++)
+               put_page(ubuf->pages[pg]);
+@@ -125,6 +126,8 @@ static int begin_cpu_udmabuf(struct dma_
+               if (IS_ERR(ubuf->sg)) {
+                       ret = PTR_ERR(ubuf->sg);
+                       ubuf->sg = NULL;
++              } else {
++                      ubuf->sg_dir = direction;
+               }
+       } else {
+               dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);