[STABLE] [PATCH] KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix

[STABLE] [PATCH] KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix

[Will Deacon]

Upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush
host FPSIMD/SVE/SME state") relies on interrupts being disabled during
fpsimd_save_and_flush_cpu_state() so that a softirq cannot be taken
while the host floating point context is being saved and potentially try
to use kernel-mode NEON.

Unfortunately, stable kernels without 9b19700e623f ("arm64: fpsimd: Drop
unneeded 'busy' flag") leave interrupts enabled in
fpsimd_save_and_flush_cpu_state() and so the BUG_ON(!may_use_simd()) in
kernel_neon_begin() has been observed to trigger in real-world usage:

 |  kernel BUG at arch/arm64/kernel/fpsimd.c:1904!
 |  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
 |
 |  Call trace:
 |   kernel_neon_begin+0xdc/0x12c
 |   ...
 |   crypto_aead_decrypt+0x5c/0x6c
 |   seqiv_aead_decrypt+0x88/0x9c
 |   crypto_aead_decrypt+0x5c/0x6c
 |   esp_input+0x280/0x364
 |   xfrm_input+0x6ac/0x16f8
 |   ...
 |   net_rx_action+0x13c/0x31c
 |   handle_softirqs+0x124/0x3d0
 |   __do_softirq+0x14/0x20
 |   ____do_softirq+0x10/0x20
 |   call_on_irq_stack+0x3c/0x74
 |   do_softirq_own_stack+0x1c/0x2c
 |   __irq_exit_rcu+0x54/0xb4
 |   irq_exit_rcu+0x10/0x1c
 |   el1_interrupt+0x38/0x58
 |   el1h_64_irq_handler+0x18/0x24
 |   el1h_64_irq+0x68/0x6c
 |   fpsimd_save+0xe4/0x130
 |   kvm_arch_vcpu_load_fp+0x2c/0x58
 |   kvm_arch_vcpu_load+0x88/0x26c
 |   kvm_sched_in+0x2c/0x3c

Given that 9b19700e623f ("arm64: fpsimd: Drop unneeded 'busy' flag") is
not a fix in its own right, has non-trivial dependencies and is a
reasonably invasive change to the in-kernel use of fpsimd, opt instead
for a simple fix to use the softirq-safe {get,put}_cpu_fpsimd_context()
helpers in fpsimd_save_and_flush_cpu_state().

Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: <stable@vger.kernel.org> # 5.15.y, 6.1.y and 6.6.y
Fixes: 806d5c1e1d2e ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") # 6.6.y
Fixes: 04c50cc23a49 ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") # 6.1.y
Fixes: 5289ac43b69c ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") # 5.15.y
Signed-off-by: Will Deacon <will@kernel.org>
---
 arch/arm64/kernel/fpsimd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index a1e0cc5353fb..d0d836448a76 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1876,10 +1876,10 @@ void fpsimd_save_and_flush_cpu_state(void)
 	if (!system_supports_fpsimd())
 		return;
 	WARN_ON(preemptible());
-	__get_cpu_fpsimd_context();
+	get_cpu_fpsimd_context();
 	fpsimd_save();
 	fpsimd_flush_cpu_state();
-	__put_cpu_fpsimd_context();
+	put_cpu_fpsimd_context();
 }
 
 #ifdef CONFIG_KERNEL_MODE_NEON
-- 
2.51.0.rc2.233.g662b1ed5c5-goog

Re: [STABLE] [PATCH] KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix

[Greg Kroah-Hartman]

On Fri, Aug 22, 2025 at 03:04:02PM +0100, Will Deacon wrote:
> Upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush
> host FPSIMD/SVE/SME state") relies on interrupts being disabled during
> fpsimd_save_and_flush_cpu_state() so that a softirq cannot be taken
> while the host floating point context is being saved and potentially try
> to use kernel-mode NEON.
> 
> Unfortunately, stable kernels without 9b19700e623f ("arm64: fpsimd: Drop
> unneeded 'busy' flag") leave interrupts enabled in
> fpsimd_save_and_flush_cpu_state() and so the BUG_ON(!may_use_simd()) in
> kernel_neon_begin() has been observed to trigger in real-world usage:
> 
>  |  kernel BUG at arch/arm64/kernel/fpsimd.c:1904!
>  |  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
>  |
>  |  Call trace:
>  |   kernel_neon_begin+0xdc/0x12c
>  |   ...
>  |   crypto_aead_decrypt+0x5c/0x6c
>  |   seqiv_aead_decrypt+0x88/0x9c
>  |   crypto_aead_decrypt+0x5c/0x6c
>  |   esp_input+0x280/0x364
>  |   xfrm_input+0x6ac/0x16f8
>  |   ...
>  |   net_rx_action+0x13c/0x31c
>  |   handle_softirqs+0x124/0x3d0
>  |   __do_softirq+0x14/0x20
>  |   ____do_softirq+0x10/0x20
>  |   call_on_irq_stack+0x3c/0x74
>  |   do_softirq_own_stack+0x1c/0x2c
>  |   __irq_exit_rcu+0x54/0xb4
>  |   irq_exit_rcu+0x10/0x1c
>  |   el1_interrupt+0x38/0x58
>  |   el1h_64_irq_handler+0x18/0x24
>  |   el1h_64_irq+0x68/0x6c
>  |   fpsimd_save+0xe4/0x130
>  |   kvm_arch_vcpu_load_fp+0x2c/0x58
>  |   kvm_arch_vcpu_load+0x88/0x26c
>  |   kvm_sched_in+0x2c/0x3c
> 
> Given that 9b19700e623f ("arm64: fpsimd: Drop unneeded 'busy' flag") is
> not a fix in its own right, has non-trivial dependencies and is a
> reasonably invasive change to the in-kernel use of fpsimd, opt instead
> for a simple fix to use the softirq-safe {get,put}_cpu_fpsimd_context()
> helpers in fpsimd_save_and_flush_cpu_state().
> 
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Cc: Lee Jones <lee@kernel.org>
> Cc: Sasha Levin <sashal@kernel.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Fuad Tabba <tabba@google.com>
> Cc: Marc Zyngier <maz@kernel.org>
> Cc: <stable@vger.kernel.org> # 5.15.y, 6.1.y and 6.6.y

Now queued up to these trees, thanks!

greg k-h