patches.lists.linux.dev archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Ard Biesheuvel <ardb@kernel.org>,
	Lee Jones <lee@kernel.org>, Sasha Levin <sashal@kernel.org>,
	Kenneth Van Alstyne <kvanals@kvanals.org>,
	Will Deacon <will@kernel.org>
Subject: [PATCH 6.6 01/28] KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
Date: Fri, 10 Oct 2025 15:16:19 +0200	[thread overview]
Message-ID: <20251010131330.412107519@linuxfoundation.org> (raw)
In-Reply-To: <20251010131330.355311487@linuxfoundation.org>

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will@kernel.org>

Stable commit 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad
backport of FPSIMD/SVE/SME fix") fixed a kernel BUG() caused by a bad
backport of upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally
save+flush host FPSIMD/SVE/SME state") by ensuring that softirqs are
disabled/enabled across the fpsimd register save operation.

Unfortunately, although this fixes the original issue, it can now lead
to deadlock when re-enabling softirqs causes pending softirqs to be
handled with locks already held:

 | BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616
 |  lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7
 | CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G           O       6.1.152 #1
 | Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023
 | Call trace:
 |  dump_backtrace+0xe4/0x110
 |  show_stack+0x20/0x30
 |  dump_stack_lvl+0x6c/0x88
 |  dump_stack+0x18/0x34
 |  spin_dump+0x98/0xac
 |  do_raw_spin_lock+0x70/0x128
 |  _raw_spin_lock+0x18/0x28
 |  raw_spin_rq_lock_nested+0x18/0x28
 |  update_blocked_averages+0x70/0x550
 |  run_rebalance_domains+0x50/0x70
 |  handle_softirqs+0x198/0x328
 |  __do_softirq+0x1c/0x28
 |  ____do_softirq+0x18/0x28
 |  call_on_irq_stack+0x30/0x48
 |  do_softirq_own_stack+0x24/0x30
 |  do_softirq+0x74/0x90
 |  __local_bh_enable_ip+0x64/0x80
 |  fpsimd_save_and_flush_cpu_state+0x5c/0x68
 |  kvm_arch_vcpu_put_fp+0x4c/0x88
 |  kvm_arch_vcpu_put+0x28/0x88
 |  kvm_sched_out+0x38/0x58
 |  __schedule+0x55c/0x6c8
 |  schedule+0x60/0xa8

Take a tiny step towards the upstream fix in 9b19700e623f ("arm64:
fpsimd: Drop unneeded 'busy' flag") by additionally disabling hardirqs
while saving the fpsimd registers.

Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org> # 6.6.y
Fixes: 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix")
Reported-by: Kenneth Van Alstyne <kvanals@kvanals.org>
Link: https://lore.kernel.org/r/010001999bae0958-4d80d25d-8dda-4006-a6b9-798f3e774f6c-000000@email.amazonses.com
Signed-off-by: Will Deacon <will@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/fpsimd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index d0d836448a76..83827384982e 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1873,13 +1873,17 @@ static void fpsimd_flush_cpu_state(void)
  */
 void fpsimd_save_and_flush_cpu_state(void)
 {
+	unsigned long flags;
+
 	if (!system_supports_fpsimd())
 		return;
 	WARN_ON(preemptible());
-	get_cpu_fpsimd_context();
+	local_irq_save(flags);
+	__get_cpu_fpsimd_context();
 	fpsimd_save();
 	fpsimd_flush_cpu_state();
-	put_cpu_fpsimd_context();
+	__put_cpu_fpsimd_context();
+	local_irq_restore(flags);
 }
 
 #ifdef CONFIG_KERNEL_MODE_NEON
-- 
2.51.0.618.g983fd99d29-goog




  reply	other threads:[~2025-10-10 13:22 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-10-10 13:16 [PATCH 6.6 00/28] 6.6.111-rc1 review Greg Kroah-Hartman
2025-10-10 13:16 ` Greg Kroah-Hartman [this message]
2025-10-10 13:16 ` [PATCH 6.6 02/28] media: tunner: xc5000: Refactor firmware load Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 03/28] media: tuner: xc5000: Fix use-after-free in xc5000_release Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 04/28] media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 05/28] USB: serial: option: add SIMCom 8230C compositions Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 06/28] wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 07/28] ASoC: amd: acp: Adjust pdm gain value Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 08/28] dm-integrity: limit MAX_TAG_SIZE to 255 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 09/28] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 10/28] perf subcmd: avoid crash in exclude_cmds when excludes is empty Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 11/28] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 12/28] btrfs: ref-verify: handle damaged extent root tree Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 13/28] can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 14/28] can: rcar_canfd: Fix controller mode setting Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 15/28] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 16/28] ALSA: usb-audio: Kill timer properly at removal Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 17/28] ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 18/28] hid: fix I2C read buffer overflow in raw_event() for mcp2221 Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 19/28] serial: stm32: allow selecting console when the driver is module Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 20/28] staging: axis-fifo: fix maximum TX packet length check Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 21/28] staging: axis-fifo: fix TX handling on copy_from_user() failure Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 22/28] staging: axis-fifo: flush RX FIFO on read errors Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 23/28] driver core/PM: Set power.no_callbacks along with power.no_pm Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 24/28] riscv: mm: Use hint address in mmap if available Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 25/28] riscv: mm: Do not restrict mmap address based on hint Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 26/28] crypto: rng - Ensure set_ent is always present Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 27/28] net/9p: fix double req put in p9_fd_cancelled Greg Kroah-Hartman
2025-10-10 13:16 ` [PATCH 6.6 28/28] KVM: x86: Dont (re)check L1 intercepts when completing userspace I/O Greg Kroah-Hartman
2025-10-10 17:14 ` [PATCH 6.6 00/28] 6.6.111-rc1 review Jon Hunter
2025-10-10 22:21 ` Shuah Khan
2025-10-11  8:56 ` Naresh Kamboju
2025-10-11 10:55 ` Mark Brown
2025-10-11 11:50 ` Ron Economos
2025-10-11 17:03 ` Brett A C Sheffield
2025-10-11 19:24 ` Peter Schneider
2025-10-12  9:24 ` Miguel Ojeda

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251010131330.412107519@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=ardb@kernel.org \
    --cc=kvanals@kvanals.org \
    --cc=lee@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).