From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 11:45:06 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=420454a47f7b24711d7ff28166c3aa2159dfb53c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch --- diff --git a/queue-6.6/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch b/queue-6.6/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch new file mode 100644 index 0000000000..81735b060d --- /dev/null +++ b/queue-6.6/kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch @@ -0,0 +1,66 @@ +From 7ef78d71ca713d8c00f7c34ddcf276c808143f77 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Thu, 18 Jun 2026 10:43:46 -0700 +Subject: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode + +From: Sean Christopherson + +commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream. + +When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in +guest mode so that a future change can have update CR8 intercepts during +vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. + + ------------[ cut here ]------------ + debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count)) + WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 + WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 + Modules linked in: + CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 + RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] + RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 + Call Trace: + + apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] + kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 + kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 + kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 + kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 + kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:597 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + +No functional change intended. + +Reported-by: syzbot ci +Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-ID: <20260618174347.1981064-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx/vmx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -6701,11 +6701,10 @@ static noinstr void vmx_l1d_flush(struct + + static void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) + { +- struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + int tpr_threshold; + + if (is_guest_mode(vcpu) && +- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) ++ nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW)) + return; + + tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr; diff --git a/queue-6.6/kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch b/queue-6.6/kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch new file mode 100644 index 0000000000..1213df309a --- /dev/null +++ b/queue-6.6/kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch @@ -0,0 +1,98 @@ +From c5bad4fa2d5dfd8c25140051a9807eba387a19b8 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 15 May 2026 15:26:29 -0700 +Subject: KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs + +From: Sean Christopherson + +commit c5bad4fa2d5dfd8c25140051a9807eba387a19b8 upstream. + +Move KVM's stuffing of GUEST_PENDING_DBG_EXCEPTIONS.BS when RFLAGS.TF=1 and +MOV/POP SS or STI blocking is active into the exception injection code so +that KVM fixes up the VMCS for all injected #DBs, not only those that are +reflected back into the guest after #DB interception. E.g. if KVM queues +a #DB in the emulator, or more importantly if userspace does save/restore +exactly on the #DB+shadow boundary, then KVM needs to massage the VMCS to +avoid the VM-Entry consistency check. + +Opportunistically update the wording of the comment to describe the +behavior as a workaround of flawed CPU behavior/architecture, to make it +clear that the *only* thing KVM is doing is fudging around a consistency +check. Per the SDM: + + There are no pending debug exceptions after VM entry if any of the + following are true: + + * The VM entry is vectoring with one of the following interruption + types: external interrupt, non-maskable interrupt (NMI), hardware + exception, or privileged software exception. + +I.e. forcing GUEST_PENDING_DBG_EXCEPTIONS.BS does *not* impact guest- +visible behavior. + +Fixes: b9bed78e2fa9 ("KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow") +Cc: stable@vger.kernel.org +Reported-by: Hou Wenlong +Closes: https://lore.kernel.org/all/b1a294bc9ed4dae532474a5dc6c8cb6e5962de7c.1757416809.git.houwenlong.hwl@antgroup.com +Reviewed-by: Hou Wenlong +Link: https://patch.msgid.link/20260515222638.1949982-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx/vmx.c | 35 ++++++++++++++++++----------------- + 1 file changed, 18 insertions(+), 17 deletions(-) + +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -1810,6 +1810,24 @@ static void vmx_inject_exception(struct + u32 intr_info = ex->vector | INTR_INFO_VALID_MASK; + struct vcpu_vmx *vmx = to_vmx(vcpu); + ++ /* ++ * When injecting a #DB, single-stepping is enabled in RFLAGS, and STI ++ * or MOV-SS blocking is active, set vmcs.PENDING_DBG_EXCEPTIONS.BS to ++ * prevent a false positive from VM-Entry consistency check. VM-Entry ++ * asserts that a single-step #DB _must_ be pending in this scenario, ++ * as the previous instruction cannot have toggled RFLAGS.TF 0=>1 ++ * (because STI and POP/MOV don't modify RFLAGS), therefore the one ++ * instruction delay when activating single-step breakpoints must have ++ * already expired. However, the CPU isn't smart enough to peek at ++ * vmcs.VM_ENTRY_INTR_INFO_FIELD and so doesn't realize that yes, there ++ * is indeed a #DB pending/imminent. ++ */ ++ if (ex->vector == DB_VECTOR && ++ (vmx_get_rflags(vcpu) & X86_EFLAGS_TF) && ++ vmx_get_interrupt_shadow(vcpu)) ++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, ++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS); ++ + kvm_deliver_exception_payload(vcpu, ex); + + if (ex->has_error_code) { +@@ -5281,26 +5299,9 @@ static int handle_exception_nmi(struct k + * avoid single-step #DB and MTF updates, as ICEBP is + * higher priority. Note, skipping ICEBP still clears + * STI and MOVSS blocking. +- * +- * For all other #DBs, set vmcs.PENDING_DBG_EXCEPTIONS.BS +- * if single-step is enabled in RFLAGS and STI or MOVSS +- * blocking is active, as the CPU doesn't set the bit +- * on VM-Exit due to #DB interception. VM-Entry has a +- * consistency check that a single-step #DB is pending +- * in this scenario as the previous instruction cannot +- * have toggled RFLAGS.TF 0=>1 (because STI and POP/MOV +- * don't modify RFLAGS), therefore the one instruction +- * delay when activating single-step breakpoints must +- * have already expired. Note, the CPU sets/clears BS +- * as appropriate for all other VM-Exits types. + */ + if (is_icebp(intr_info)) + WARN_ON(!skip_emulated_instruction(vcpu)); +- else if ((vmx_get_rflags(vcpu) & X86_EFLAGS_TF) && +- (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & +- (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS))) +- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, +- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS); + + kvm_queue_exception_p(vcpu, DB_VECTOR, dr6); + return 1; diff --git a/queue-6.6/series b/queue-6.6/series index e4e4f2560f..b48e105cee 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -299,3 +299,6 @@ riscv-mm-define-direct_map_physmem_end.patch module-decompress-check-return-value-of-module_extend_max_pages.patch exfat-bound-uniname-advance-in-exfat_find_dir_entry.patch ntb-epf-fix-request_irq-unwind-in-ntb_epf_init_isr.patch +kvm-vmx-refresh-guest_pending_dbg_exceptions.bs-on-all-injected-dbs.patch +kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch +udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch diff --git a/queue-6.6/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch b/queue-6.6/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch new file mode 100644 index 0000000000..266a687b4b --- /dev/null +++ b/queue-6.6/udmabuf-fix-dma-direction-mismatch-in-release_udmabuf.patch @@ -0,0 +1,70 @@ +From fb7b1a0ab25a6077d26cb3829e31743972d4f31d Mon Sep 17 00:00:00 2001 +From: Mikhail Gavrilov +Date: Sun, 15 Mar 2026 04:27:22 +0500 +Subject: udmabuf: fix DMA direction mismatch in release_udmabuf() + +From: Mikhail Gavrilov + +commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream. + +begin_cpu_udmabuf() maps the sg_table with the caller-provided direction +(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg +for reuse. However, release_udmabuf() always unmaps this sg_table with +a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was +originally used for the mapping. + +With CONFIG_DMA_API_DEBUG=y this produces: + + DMA-API: misc udmabuf: device driver frees DMA memory with different + direction [device address=0x000000044a123000] [size=4096 bytes] + [mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL] + +The issue was found during video playback when GStreamer performed a +write-only DMA_BUF_IOCTL_SYNC on a udmabuf. It can be reproduced +with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd, +performing a write-only sync (DMA_BUF_SYNC_WRITE without +DMA_BUF_SYNC_READ), and closing the file descriptor. + +Fix this by storing the DMA direction used when the sg_table is first +created in begin_cpu_udmabuf(), and passing that same direction to +put_sg_table() in release_udmabuf(). + +Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks") +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Gavrilov +Reviewed-by: Vivek Kasireddy +Signed-off-by: Vivek Kasireddy +Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma-buf/udmabuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -27,6 +27,7 @@ struct udmabuf { + pgoff_t pagecount; + struct page **pages; + struct sg_table *sg; ++ enum dma_data_direction sg_dir; + struct miscdevice *device; + }; + +@@ -139,7 +140,7 @@ static void release_udmabuf(struct dma_b + pgoff_t pg; + + if (ubuf->sg) +- put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL); ++ put_sg_table(dev, ubuf->sg, ubuf->sg_dir); + + for (pg = 0; pg < ubuf->pagecount; pg++) + put_page(ubuf->pages[pg]); +@@ -159,6 +160,8 @@ static int begin_cpu_udmabuf(struct dma_ + if (IS_ERR(ubuf->sg)) { + ret = PTR_ERR(ubuf->sg); + ubuf->sg = NULL; ++ } else { ++ ubuf->sg_dir = direction; + } + } else { + dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);