From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCF9B3FB7F3 for ; Fri, 12 Jun 2026 23:06:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781305601; cv=none; b=WCujMl6rZsQNLZyxr5bIom3E8KMe1+ilzk+EZm22as6hj/Pyad6fgDEFcqee0OwjcVylOX8QbrR8fje726W8CyxTkwn/SUJuMFvlALF/YWJKHDomUQhpSSKOFu9PvKoCpFmwCN9f0iC4jBjWRxdb4lCT9E9dalp7gMePvCMIBFg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781305601; c=relaxed/simple; bh=IsZj3GCjbyKgtlPYUFvawVO77VGZHPyAp0mIzBAb3tw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=aqDYpx0pIkAPQ7rX4OJ3CmGnNtAdw7MjQnlvASbwZpsLqbEK2wMxDtRlf9Twwwv8rgKSUzYxPmm7uRyMvPtS1VqR8mDdiRKxCKDrs4fLqiUVYKm+jTSTOwZ7EyhyV44H/ivsNV2SGhgNbuaxE9MWS6qygH9auhvzr6elrJKAVHs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=A/atfnRT; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="A/atfnRT" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2bf1dece2ecso15411345ad.1 for ; Fri, 12 Jun 2026 16:06:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781305599; x=1781910399; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=Xzf6kQdtL42DvWCKAV6DWM3aXCjqzDNCsirfABQj8mg=; b=A/atfnRT3DoPDBN+s2sjjff32+TUFJViK43cZNbDbUNb7+LrGVxewzEOiyy0vhANG3 RxQeicXz4tXQAkidCNPQOti5kM/OpvUoQSn/7VMBLJV/+/CElC7jtcpo0J4hdFUC8G6E s4c2wBdv8ZL5oGGLjdae1vdPG9TzpGvjjJvKd2jvmu8gUgi6t/MBokTGU5ddD1xTeiNW wuJkiE/PhumxNRhgkRZtOyUcLuZkh+m95o4lJVqB+ecI1Tcp75/iGEbV1gdYR00YLucR v9O8mpdyrzJ09iE7Wak3NUGAERP0wQiYulrtXbk8a73ICY2I39Q8WKTpt1rDz2/if5cY Z6hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781305599; x=1781910399; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Xzf6kQdtL42DvWCKAV6DWM3aXCjqzDNCsirfABQj8mg=; b=Uu1Q4typZlPMFfy3c44kSA95eXgBzNd39jsiClIq93V3P6Ik+7fqei4l3s4Z+vx+ka yh5T1W5YPSvD5XsIO/hwBaHvNzQzBPS6HTbfCNPxSYOUoJt0P9U8bwlET4bYMmeNUCYM 3cTxz32lo9aGilcQ7Hf8ns4903i00nOt2/LuKjPc/KiocQFpd38yim1pM1E6PK+5VV3U QvMsmqPCgwio+MFJ/bplwwKHGetwV3d1RiLTBEu2JZjYME/Fausg8nrbot/hHTM8H+tR cq3GldY2QBK+KjfaYlrBzECNFJEDMzsYbXcaLxmkSOygSVq4SFpYxqkct+SZWqB3LKLK Ie4A== X-Forwarded-Encrypted: i=1; AFNElJ+BC6KSqR3WNbW69+kJ4I/tEv3rKyC6KHCYry9942OJpLkjjDBgtt0HnlJn/jJ18hi0T6tcGKZ+qRcGlcQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwXy0a9/JkLVOgFwLKApu+r4rg/ArOOilq0uqcDWYtBnk0Y+iyX pc9UnE7Xm3HEWMwXqUKeBh3RoL+al2ed3e7oLqCEWIVD8Mvfn/tmugf1RvB3yfm42QptNZI6HY0 2FmAbSA== X-Received: from plbku11.prod.google.com ([2002:a17:903:288b:b0:2b2:51df:a515]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ccd0:b0:2c2:50c7:58a0 with SMTP id d9443c01a7336-2c6642743ddmr15600155ad.23.1781305598994; Fri, 12 Jun 2026 16:06:38 -0700 (PDT) Reply-To: Sean Christopherson Date: Fri, 12 Jun 2026 16:06:21 -0700 In-Reply-To: <20260612230622.687665-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260612230622.687665-1-seanjc@google.com> X-Mailer: git-send-email 2.54.0.1136.gdb2ca164c4-goog Message-ID: <20260612230622.687665-8-seanjc@google.com> Subject: [PATCH v2 7/8] KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu() From: Sean Christopherson To: Vitaly Kuznetsov , Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+5b32c49cd8f005e65654@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" Assert that either vcpu->mutex is held or the VM is otherwise unreachable when using the normal vCPU => HyperV accessor to help detect improper cross-task usage of the HyperV structure. When accessing the structure without holding the vCPU's mutex, e.g. to send interrupts or to queue TLB flushes, KVM needs to use the more paranoid to_hv_vcpu_safe() to guarantee that it can't see a half-baked structure. To avoid false positives, open code accesses to vcpu->arch.hyperv in the Synthetic Timer callbacks (can be reached if and only if HyperV state is fully initialized). Signed-off-by: Sean Christopherson --- arch/x86/kvm/hyperv.c | 6 ++---- arch/x86/kvm/hyperv.h | 2 ++ 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index 107eb7df20f1..7efe2907148f 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -599,8 +599,7 @@ static void stimer_mark_pending(struct kvm_vcpu_hv_stimer *stimer, { struct kvm_vcpu *vcpu = hv_stimer_to_vcpu(stimer); - set_bit(stimer->index, - to_hv_vcpu(vcpu)->stimer_pending_bitmap); + set_bit(stimer->index, vcpu->arch.hyperv->stimer_pending_bitmap); kvm_make_request(KVM_REQ_HV_STIMER, vcpu); if (vcpu_kick) kvm_vcpu_kick(vcpu); @@ -614,8 +613,7 @@ static void stimer_cleanup(struct kvm_vcpu_hv_stimer *stimer) stimer->index); hrtimer_cancel(&stimer->timer); - clear_bit(stimer->index, - to_hv_vcpu(vcpu)->stimer_pending_bitmap); + clear_bit(stimer->index, vcpu->arch.hyperv->stimer_pending_bitmap); stimer->msg_pending = false; stimer->exp_time = 0; } diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h index 821b586ed746..f78ab3c8d11a 100644 --- a/arch/x86/kvm/hyperv.h +++ b/arch/x86/kvm/hyperv.h @@ -75,6 +75,8 @@ static inline struct kvm_vcpu_hv *to_hv_vcpu_safe(struct kvm_vcpu *vcpu) static inline struct kvm_vcpu_hv *to_hv_vcpu(struct kvm_vcpu *vcpu) { + kvm_lockdep_assert_vcpu_is_locked_or_unreachable(vcpu); + return vcpu->arch.hyperv; } -- 2.54.0.1136.gdb2ca164c4-goog