Linux kernel -stable discussions
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] KVM: x86: Check for invalid/obsolete root *after* making MMU" failed to apply to 5.15-stable tree
@ 2026-07-25  6:52 gregkh
  2026-07-30 19:29 ` [PATCH 5.15.y 1/6] KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Sasha Levin
  2026-08-23 13:07 ` [PATCH 5.15.y v2 0/8] backport for CVE-2026-64561 Kenta Akagi
  0 siblings, 2 replies; 21+ messages in thread
From: gregkh @ 2026-07-25  6:52 UTC (permalink / raw)
  To: seanjc, imv4bel, pbonzini; +Cc: stable


The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 2abd5287f08319fa35764566b15c6e22cb1068db
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072557-gem-defensive-a757@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 2abd5287f08319fa35764566b15c6e22cb1068db Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Mon, 13 Jul 2026 08:15:33 -0700
Subject: [PATCH] KVM: x86: Check for invalid/obsolete root *after* making MMU
 pages available

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU.  If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root.  On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.

Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Fixes: f95eec9bed76 ("KVM: x86/mmu: Don't put invalid SPs back on the list of active pages")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 234d0a95abf5..41f92ed1ca37 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4852,16 +4852,17 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 	if (r != RET_PF_CONTINUE)
 		return r;
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
 
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = direct_map(vcpu, fault);
 
 out_unlock:
diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index df3ae0c7ec2c..1ba840a73b7a 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -864,15 +864,17 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 	}
 #endif
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
+
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = FNAME(fetch)(vcpu, fault, &walker);
 
 out_unlock:


^ permalink raw reply related	[flat|nested] 21+ messages in thread
end of thread, other threads:[~2026-08-25 11:49 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-25  6:52 FAILED: patch "[PATCH] KVM: x86: Check for invalid/obsolete root *after* making MMU" failed to apply to 5.15-stable tree gregkh
2026-07-30 19:29 ` [PATCH 5.15.y 1/6] KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Sasha Levin
2026-07-30 19:29   ` [PATCH 5.15.y 2/6] KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sasha Levin
2026-07-30 19:29   ` [PATCH 5.15.y 3/6] KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sasha Levin
2026-07-30 19:29   ` [PATCH 5.15.y 4/6] KVM: Rename mmu_notifier_* to mmu_invalidate_* Sasha Levin
2026-07-30 19:29   ` [PATCH 5.15.y 5/6] KVM: x86/mmu: Split out TDP MMU page fault handling Sasha Levin
2026-07-30 19:29   ` [PATCH 5.15.y 6/6] KVM: x86/mmu: Rename __direct_map() to direct_map() Sasha Levin
2026-08-06 16:19     ` Harshit Mogalapalli
2026-08-06 16:50       ` Sasha Levin
2026-08-21 12:38     ` Kenta Akagi
2026-08-23  3:42       ` Sasha Levin
2026-08-23 13:07 ` [PATCH 5.15.y v2 0/8] backport for CVE-2026-64561 Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 1/8] KVM: x86/mmu: Retry page fault if root is invalidated by memslot update Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 2/8] KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 3/8] KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 4/8] KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 5/8] KVM: Rename mmu_notifier_* to mmu_invalidate_* Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 6/8] KVM: x86/mmu: Split out TDP MMU page fault handling Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 7/8] KVM: x86/mmu: Rename __direct_map() to direct_map() Kenta Akagi
2026-08-23 13:07   ` [PATCH 5.15.y v2 8/8] KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Kenta Akagi
2026-08-25 11:49   ` [PATCH 5.15.y v2 0/8] backport for CVE-2026-64561 Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox