Re: [PATCH] KVM: VMX: Postpone IPIv setup after successful vCPU creation

[Sean Christopherson <seanjc@google.com>]

On Mon, Jul 20, 2026, Naveen N Rao wrote:
> On Thu, Jul 16, 2026 at 07:24:10PM +0200, Dmytro Maluka wrote:
> > On Thu, Jul 16, 2026 at 04:29:00PM +0000, sashiko-bot@kernel.org wrote:
> > > [Severity: Critical]
> > > This isn't a bug introduced by this patch, but does this exact same
> > > vulnerability exist in the AMD SVM AVIC code?
> > > 
> > > It looks like the SVM code suffers from the same use-after-free pattern
> > > when userspace creates a duplicate vCPU ID.
> > 
> > Seems plausible. Can someone with AMD expertise look into this?
> > 
> > > In arch/x86/kvm/svm/avic.c:avic_init_backing_page(), the newly allocated
> > > APIC backing page address is written into the VM-wide hardware IPI table
> > > before the vCPU ID duplicate check:
> > > 
> > >     WRITE_ONCE(kvm_svm->avic_physical_id_table[id], new_entry);
> 
> Yes, this write (or just setting AVIC_PHYSICAL_ID_ENTRY_VALID_MASK) will 
> need to be delayed to a post-create phase similar to VMX.
> 
> The alternative is to simply skip setting the entry valid during vCPU 
> creation and to instead do it unconditionally during vcpu_load(), where 
> we anyway have to update the entry.

Won't work, vcpu_load() is called during vCPU creation.  :-(