From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Ard Biesheuvel <ardb@kernel.org>,
Lee Jones <lee@kernel.org>, Sasha Levin <sashal@kernel.org>,
Kenneth Van Alstyne <kvanals@kvanals.org>,
Will Deacon <will@kernel.org>
Subject: [PATCH 6.6 01/28] KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
Date: Fri, 10 Oct 2025 15:16:19 +0200 [thread overview]
Message-ID: <20251010131330.412107519@linuxfoundation.org> (raw)
In-Reply-To: <20251010131330.355311487@linuxfoundation.org>
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will@kernel.org>
Stable commit 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad
backport of FPSIMD/SVE/SME fix") fixed a kernel BUG() caused by a bad
backport of upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally
save+flush host FPSIMD/SVE/SME state") by ensuring that softirqs are
disabled/enabled across the fpsimd register save operation.
Unfortunately, although this fixes the original issue, it can now lead
to deadlock when re-enabling softirqs causes pending softirqs to be
handled with locks already held:
| BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616
| lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7
| CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G O 6.1.152 #1
| Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023
| Call trace:
| dump_backtrace+0xe4/0x110
| show_stack+0x20/0x30
| dump_stack_lvl+0x6c/0x88
| dump_stack+0x18/0x34
| spin_dump+0x98/0xac
| do_raw_spin_lock+0x70/0x128
| _raw_spin_lock+0x18/0x28
| raw_spin_rq_lock_nested+0x18/0x28
| update_blocked_averages+0x70/0x550
| run_rebalance_domains+0x50/0x70
| handle_softirqs+0x198/0x328
| __do_softirq+0x1c/0x28
| ____do_softirq+0x18/0x28
| call_on_irq_stack+0x30/0x48
| do_softirq_own_stack+0x24/0x30
| do_softirq+0x74/0x90
| __local_bh_enable_ip+0x64/0x80
| fpsimd_save_and_flush_cpu_state+0x5c/0x68
| kvm_arch_vcpu_put_fp+0x4c/0x88
| kvm_arch_vcpu_put+0x28/0x88
| kvm_sched_out+0x38/0x58
| __schedule+0x55c/0x6c8
| schedule+0x60/0xa8
Take a tiny step towards the upstream fix in 9b19700e623f ("arm64:
fpsimd: Drop unneeded 'busy' flag") by additionally disabling hardirqs
while saving the fpsimd registers.
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org> # 6.6.y
Fixes: 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix")
Reported-by: Kenneth Van Alstyne <kvanals@kvanals.org>
Link: https://lore.kernel.org/r/010001999bae0958-4d80d25d-8dda-4006-a6b9-798f3e774f6c-000000@email.amazonses.com
Signed-off-by: Will Deacon <will@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/fpsimd.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index d0d836448a76..83827384982e 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1873,13 +1873,17 @@ static void fpsimd_flush_cpu_state(void)
*/
void fpsimd_save_and_flush_cpu_state(void)
{
+ unsigned long flags;
+
if (!system_supports_fpsimd())
return;
WARN_ON(preemptible());
- get_cpu_fpsimd_context();
+ local_irq_save(flags);
+ __get_cpu_fpsimd_context();
fpsimd_save();
fpsimd_flush_cpu_state();
- put_cpu_fpsimd_context();
+ __put_cpu_fpsimd_context();
+ local_irq_restore(flags);
}
#ifdef CONFIG_KERNEL_MODE_NEON
--
2.51.0.618.g983fd99d29-goog
next prev parent reply other threads:[~2025-10-10 13:22 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-10 13:16 [PATCH 6.6 00/28] 6.6.111-rc1 review Greg Kroah-Hartman
2025-10-10 13:16 ` Greg Kroah-Hartman [this message]
2025-10-10 13:16 ` [PATCH 6.6 02/28] media: tunner: xc5000: Refactor firmware load Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 03/28] media: tuner: xc5000: Fix use-after-free in xc5000_release Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 04/28] media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 05/28] USB: serial: option: add SIMCom 8230C compositions Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 06/28] wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 07/28] ASoC: amd: acp: Adjust pdm gain value Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 08/28] dm-integrity: limit MAX_TAG_SIZE to 255 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 09/28] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 10/28] perf subcmd: avoid crash in exclude_cmds when excludes is empty Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 11/28] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 12/28] btrfs: ref-verify: handle damaged extent root tree Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 13/28] can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 14/28] can: rcar_canfd: Fix controller mode setting Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 15/28] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 16/28] ALSA: usb-audio: Kill timer properly at removal Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 17/28] ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 18/28] hid: fix I2C read buffer overflow in raw_event() for mcp2221 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 19/28] serial: stm32: allow selecting console when the driver is module Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 20/28] staging: axis-fifo: fix maximum TX packet length check Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 21/28] staging: axis-fifo: fix TX handling on copy_from_user() failure Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 22/28] staging: axis-fifo: flush RX FIFO on read errors Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 23/28] driver core/PM: Set power.no_callbacks along with power.no_pm Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 24/28] riscv: mm: Use hint address in mmap if available Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 25/28] riscv: mm: Do not restrict mmap address based on hint Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 26/28] crypto: rng - Ensure set_ent is always present Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 27/28] net/9p: fix double req put in p9_fd_cancelled Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 28/28] KVM: x86: Dont (re)check L1 intercepts when completing userspace I/O Greg Kroah-Hartman
2025-10-10 17:14 ` [PATCH 6.6 00/28] 6.6.111-rc1 review Jon Hunter
2025-10-10 22:21 ` Shuah Khan
2025-10-11 8:56 ` Naresh Kamboju
2025-10-11 10:55 ` Mark Brown
2025-10-11 11:50 ` Ron Economos
2025-10-11 17:03 ` Brett A C Sheffield
2025-10-11 19:24 ` Peter Schneider
2025-10-12 9:24 ` Miguel Ojeda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251010131330.412107519@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ardb@kernel.org \
--cc=kvanals@kvanals.org \
--cc=lee@kernel.org \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).