From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 11:44:37 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=26357199a6ac5a1fa773c46909f4663c5b15355d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch --- diff --git a/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch b/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch new file mode 100644 index 0000000000..1d799d0447 --- /dev/null +++ b/queue-5.10/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch @@ -0,0 +1,66 @@ +From 7ef78d71ca713d8c00f7c34ddcf276c808143f77 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Thu, 18 Jun 2026 10:43:46 -0700 +Subject: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode + +From: Sean Christopherson + +commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream. + +When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in +guest mode so that a future change can have update CR8 intercepts during +vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. + + ------------[ cut here ]------------ + debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count)) + WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 + WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 + Modules linked in: + CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 + RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] + RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 + Call Trace: + + apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] + kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 + kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 + kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 + kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 + kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:597 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + +No functional change intended. + +Reported-by: syzbot ci +Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-ID: <20260618174347.1981064-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx/vmx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -6309,11 +6309,10 @@ static noinstr void vmx_l1d_flush(struct + + static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) + { +- struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + int tpr_threshold; + + if (is_guest_mode(vcpu) && +- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) ++ nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW)) + return; + + tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr; diff --git a/queue-5.10/series b/queue-5.10/series index f7c960eb54..e63d84a2ea 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -138,3 +138,5 @@ spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch tracing-prevent-out-of-bounds-read-in-glob-matching.patch nfsv4-include-may_write-in-open-permission-mask-for-o_trunc.patch exfat-bound-uniname-advance-in-exfat_find_dir_entry.patch +kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch +udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch diff --git a/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch b/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch new file mode 100644 index 0000000000..e540d2507b --- /dev/null +++ b/queue-5.10/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch @@ -0,0 +1,70 @@ +From fb7b1a0ab25a6077d26cb3829e31743972d4f31d Mon Sep 17 00:00:00 2001 +From: Mikhail Gavrilov +Date: Sun, 15 Mar 2026 04:27:22 +0500 +Subject: udmabuf: fix DMA direction mismatch in release_udmabuf() + +From: Mikhail Gavrilov + +commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream. + +begin_cpu_udmabuf() maps the sg_table with the caller-provided direction +(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg +for reuse. However, release_udmabuf() always unmaps this sg_table with +a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was +originally used for the mapping. + +With CONFIG_DMA_API_DEBUG=y this produces: + + DMA-API: misc udmabuf: device driver frees DMA memory with different + direction [device address=0x000000044a123000] [size=4096 bytes] + [mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL] + +The issue was found during video playback when GStreamer performed a +write-only DMA_BUF_IOCTL_SYNC on a udmabuf. It can be reproduced +with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd, +performing a write-only sync (DMA_BUF_SYNC_WRITE without +DMA_BUF_SYNC_READ), and closing the file descriptor. + +Fix this by storing the DMA direction used when the sg_table is first +created in begin_cpu_udmabuf(), and passing that same direction to +put_sg_table() in release_udmabuf(). + +Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks") +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Gavrilov +Reviewed-by: Vivek Kasireddy +Signed-off-by: Vivek Kasireddy +Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma-buf/udmabuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -19,6 +19,7 @@ struct udmabuf { + pgoff_t pagecount; + struct page **pages; + struct sg_table *sg; ++ enum dma_data_direction sg_dir; + struct miscdevice *device; + }; + +@@ -105,7 +106,7 @@ static void release_udmabuf(struct dma_b + pgoff_t pg; + + if (ubuf->sg) +- put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL); ++ put_sg_table(dev, ubuf->sg, ubuf->sg_dir); + + for (pg = 0; pg < ubuf->pagecount; pg++) + put_page(ubuf->pages[pg]); +@@ -125,6 +126,8 @@ static int begin_cpu_udmabuf(struct dma_ + if (IS_ERR(ubuf->sg)) { + ret = PTR_ERR(ubuf->sg); + ubuf->sg = NULL; ++ } else { ++ ubuf->sg_dir = direction; + } + } else { + dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);