--- /dev/null
+From 7ef78d71ca713d8c00f7c34ddcf276c808143f77 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Thu, 18 Jun 2026 10:43:46 -0700
+Subject: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream.
+
+When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
+guest mode so that a future change can have update CR8 intercepts during
+vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
+
+ ------------[ cut here ]------------
+ debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
+ WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
+ WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
+ RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
+ RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
+ Call Trace:
+ <TASK>
+ apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
+ kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
+ kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
+ kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
+ kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
+ kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:597 [inline]
+ __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+ </TASK>
+
+No functional change intended.
+
+Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
+Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20260618174347.1981064-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx/vmx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -6701,11 +6701,10 @@ static noinstr void vmx_l1d_flush(struct
+
+ static void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+ {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ int tpr_threshold;
+
+ if (is_guest_mode(vcpu) &&
+- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++ nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW))
+ return;
+
+ tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;
--- /dev/null
+From c5bad4fa2d5dfd8c25140051a9807eba387a19b8 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Fri, 15 May 2026 15:26:29 -0700
+Subject: KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit c5bad4fa2d5dfd8c25140051a9807eba387a19b8 upstream.
+
+Move KVM's stuffing of GUEST_PENDING_DBG_EXCEPTIONS.BS when RFLAGS.TF=1 and
+MOV/POP SS or STI blocking is active into the exception injection code so
+that KVM fixes up the VMCS for all injected #DBs, not only those that are
+reflected back into the guest after #DB interception. E.g. if KVM queues
+a #DB in the emulator, or more importantly if userspace does save/restore
+exactly on the #DB+shadow boundary, then KVM needs to massage the VMCS to
+avoid the VM-Entry consistency check.
+
+Opportunistically update the wording of the comment to describe the
+behavior as a workaround of flawed CPU behavior/architecture, to make it
+clear that the *only* thing KVM is doing is fudging around a consistency
+check. Per the SDM:
+
+ There are no pending debug exceptions after VM entry if any of the
+ following are true:
+
+ * The VM entry is vectoring with one of the following interruption
+ types: external interrupt, non-maskable interrupt (NMI), hardware
+ exception, or privileged software exception.
+
+I.e. forcing GUEST_PENDING_DBG_EXCEPTIONS.BS does *not* impact guest-
+visible behavior.
+
+Fixes: b9bed78e2fa9 ("KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow")
+Cc: stable@vger.kernel.org
+Reported-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Closes: https://lore.kernel.org/all/b1a294bc9ed4dae532474a5dc6c8cb6e5962de7c.1757416809.git.houwenlong.hwl@antgroup.com
+Reviewed-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Link: https://patch.msgid.link/20260515222638.1949982-2-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx/vmx.c | 35 ++++++++++++++++++-----------------
+ 1 file changed, 18 insertions(+), 17 deletions(-)
+
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -1810,6 +1810,24 @@ static void vmx_inject_exception(struct
+ u32 intr_info = ex->vector | INTR_INFO_VALID_MASK;
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+
++ /*
++ * When injecting a #DB, single-stepping is enabled in RFLAGS, and STI
++ * or MOV-SS blocking is active, set vmcs.PENDING_DBG_EXCEPTIONS.BS to
++ * prevent a false positive from VM-Entry consistency check. VM-Entry
++ * asserts that a single-step #DB _must_ be pending in this scenario,
++ * as the previous instruction cannot have toggled RFLAGS.TF 0=>1
++ * (because STI and POP/MOV don't modify RFLAGS), therefore the one
++ * instruction delay when activating single-step breakpoints must have
++ * already expired. However, the CPU isn't smart enough to peek at
++ * vmcs.VM_ENTRY_INTR_INFO_FIELD and so doesn't realize that yes, there
++ * is indeed a #DB pending/imminent.
++ */
++ if (ex->vector == DB_VECTOR &&
++ (vmx_get_rflags(vcpu) & X86_EFLAGS_TF) &&
++ vmx_get_interrupt_shadow(vcpu))
++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS);
++
+ kvm_deliver_exception_payload(vcpu, ex);
+
+ if (ex->has_error_code) {
+@@ -5281,26 +5299,9 @@ static int handle_exception_nmi(struct k
+ * avoid single-step #DB and MTF updates, as ICEBP is
+ * higher priority. Note, skipping ICEBP still clears
+ * STI and MOVSS blocking.
+- *
+- * For all other #DBs, set vmcs.PENDING_DBG_EXCEPTIONS.BS
+- * if single-step is enabled in RFLAGS and STI or MOVSS
+- * blocking is active, as the CPU doesn't set the bit
+- * on VM-Exit due to #DB interception. VM-Entry has a
+- * consistency check that a single-step #DB is pending
+- * in this scenario as the previous instruction cannot
+- * have toggled RFLAGS.TF 0=>1 (because STI and POP/MOV
+- * don't modify RFLAGS), therefore the one instruction
+- * delay when activating single-step breakpoints must
+- * have already expired. Note, the CPU sets/clears BS
+- * as appropriate for all other VM-Exits types.
+ */
+ if (is_icebp(intr_info))
+ WARN_ON(!skip_emulated_instruction(vcpu));
+- else if ((vmx_get_rflags(vcpu) & X86_EFLAGS_TF) &&
+- (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+- (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS)))
+- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
+- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS);
+
+ kvm_queue_exception_p(vcpu, DB_VECTOR, dr6);
+ return 1;
module-decompress-check-return-value-of-module_extend_max_pages.patch
exfat-bound-uniname-advance-in-exfat_find_dir_entry.patch
ntb-epf-fix-request_irq-unwind-in-ntb_epf_init_isr.patch
+kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch
+kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
+udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch
--- /dev/null
+From fb7b1a0ab25a6077d26cb3829e31743972d4f31d Mon Sep 17 00:00:00 2001
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Date: Sun, 15 Mar 2026 04:27:22 +0500
+Subject: udmabuf: fix DMA direction mismatch in release_udmabuf()
+
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+
+commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream.
+
+begin_cpu_udmabuf() maps the sg_table with the caller-provided direction
+(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg
+for reuse. However, release_udmabuf() always unmaps this sg_table with
+a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was
+originally used for the mapping.
+
+With CONFIG_DMA_API_DEBUG=y this produces:
+
+ DMA-API: misc udmabuf: device driver frees DMA memory with different
+ direction [device address=0x000000044a123000] [size=4096 bytes]
+ [mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL]
+
+The issue was found during video playback when GStreamer performed a
+write-only DMA_BUF_IOCTL_SYNC on a udmabuf. It can be reproduced
+with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd,
+performing a write-only sync (DMA_BUF_SYNC_WRITE without
+DMA_BUF_SYNC_READ), and closing the file descriptor.
+
+Fix this by storing the DMA direction used when the sg_table is first
+created in begin_cpu_udmabuf(), and passing that same direction to
+put_sg_table() in release_udmabuf().
+
+Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma-buf/udmabuf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -27,6 +27,7 @@ struct udmabuf {
+ pgoff_t pagecount;
+ struct page **pages;
+ struct sg_table *sg;
++ enum dma_data_direction sg_dir;
+ struct miscdevice *device;
+ };
+
+@@ -139,7 +140,7 @@ static void release_udmabuf(struct dma_b
+ pgoff_t pg;
+
+ if (ubuf->sg)
+- put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
++ put_sg_table(dev, ubuf->sg, ubuf->sg_dir);
+
+ for (pg = 0; pg < ubuf->pagecount; pg++)
+ put_page(ubuf->pages[pg]);
+@@ -159,6 +160,8 @@ static int begin_cpu_udmabuf(struct dma_
+ if (IS_ERR(ubuf->sg)) {
+ ret = PTR_ERR(ubuf->sg);
+ ubuf->sg = NULL;
++ } else {
++ ubuf->sg_dir = direction;
+ }
+ } else {
+ dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);
projects / thirdparty / kernel / stable-queue.git / commitdiff
