From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f54.google.com (mail-qv1-f54.google.com [209.85.219.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4737035E926 for ; Fri, 19 Jun 2026 20:31:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781901119; cv=none; b=VLRkwmpePoJg56AI3ZBVEupKPEInXq3BXS5zA7ktV3uLMo4jx644PmnsnkuO4It28Fd1+LVvNZ8BXu6O2ZQ6p8uV4CcyNjPM7Lj5MSIjBpamv80xTqpzVd2jreMU/OSYgKkmLn+PhR+f5xM4wPz/tT9FTalOEbwKSkHVBstq7Zs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781901119; c=relaxed/simple; bh=/E8mnLJj+epl51cgxm9LLIajhOl8c3FpUCtgX8rsvr0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=r34sJ9auKV5GXXHkzrqIS/B8HC7yPSFiE/wXBThpZqY8dgQZ3KRTkqmaoUa3hyaaG8dVW6m1um/OaCjnvS7nfhjRuHrO15vF6JzfdLKfBmbkEAsjEVsffOlBAUNRtpHAZa6A0++6MpqCnaVHaSYgTMteLZ+Y7F1ELyjFs/9xkiM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=g3D1LZ9i; arc=none smtp.client-ip=209.85.219.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="g3D1LZ9i" Received: by mail-qv1-f54.google.com with SMTP id 6a1803df08f44-8ccf0fa0aacso32870656d6.2 for ; Fri, 19 Jun 2026 13:31:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781901113; x=1782505913; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=izLjqw/INKe5R0s/VDFVyTgV/leWjpu/ky1a2+ufVt0=; b=g3D1LZ9ivgMH6fOJAX9xq+Y80kPJKqGw1FWrPjJXgMuxl+EoOmFRKi6yOqWQYwm+H8 +aFzBW7jhL85OWl7gxKr18141VpS1sJhFJsITN/EmUjdSDjM56gl24ULOUv0Lj03Ywg1 x7bot0pT1clTjBjA5UHzMa8QqFmTiLw2y9dT7QGY2bztftF13HERJYHaue/1csRZFT9w 9m6RM+8dTmoWYemwgSidHVLdgJ1CVgiluFj0XIN+PQHZepaC1OzUFixCWY+DHrvceIXx qjdMGj1ik4PPXiGfSgJuLbXK1jeqKzudOgRZyKUYo8sT/bkaNTLBxWBlnRXIX0F+AzX1 WElw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781901113; x=1782505913; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=izLjqw/INKe5R0s/VDFVyTgV/leWjpu/ky1a2+ufVt0=; b=LW9Iv9smVQXH4Vq7ci1lb3Cb663bVjLDDVWvxz3aXkY6qyDR8bcj/R9R/JQD5BS078 cQEBdL3XcWnIqp/3fmOmlKf6GO/1BDqEzlKquxbeHz78b3gMbWTV8Uj3XRsBB2O2Hx26 zCPHdD1+M59P7FHR86F9syGvGT241Vf4tDEtCPVefEaoeTxMzMisGAwoixSRJpDRgWaT 9KmSwPY6qG+3xSECfob1ij3sqFLm5cLTLpD42CLmmJisRor5bvBlItgTqV7Wqnw4igKv 35KA5KnEZh15D0VY64XrUNbqwboHe7Y4hfviervTDH2cuc2siR4q3QLVkuTWume7YJcH itUA== X-Forwarded-Encrypted: i=1; AFNElJ8CrWKmJ1wCSJ8p7EO+a128gXuXnLL2GZyVd2N4U4C5mKX+J8tHMJMqLppXVaQVVndO1WLUq4zJNcaxhkE=@vger.kernel.org X-Gm-Message-State: AOJu0YwKJt0Z0cetV0ylaFZ1RKdiB5NjIfU0c+pX3JCrfzH2z49Uu/Mc ZnJTFcZTlJUFbRbDI+CP+8mXkxP/kSddh4VhloDZUsmdKRPUjjKsvDAO X-Gm-Gg: AfdE7cm3XcgMNK7DFf/ncWg4W8++KTrmAmlVJzAzf8/oIEiHGiXcmm2uE7Tp0s9e1NX mQsGK48Ud2AoUIz0UhWUwSJ0PfxKSKIGbRuEKFym2DGDex8br/WNRLxEwWV7Lvh3SUxnXeq9V+I xiIBz5YtAM++9Yq79MRctE9TpAdl7T6m8j4+qY60x2h6f4vr8FCXZCN8WPrxq6axMPHsQkzEtbo WucGVqrJK71H06lm2lVkdJ4OX4QoQtKAWNsSEJqvltWAQ6zI40OlzJRqZ9m40OY+ZtpWhL6BAoD c53kGrchXdh1896BRRxlsiw/1dOO+7TTtScHJH1HqG5uk7h0IDOJUhmjGwW2V+KcT0voqLUbsKG EVajWcgoscuTzu1UzpqOtZFsJfp5jgeQN/3vZ1pil1uxteVk8QNOpMzKJkDnqTVmbFJ6ResO+wt Q8Ekm81I7V48MEU2E= X-Received: by 2002:a0c:e00a:0:b0:8ce:cada:9ce9 with SMTP id 6a1803df08f44-8de40dfe555mr76250166d6.21.1781901113220; Fri, 19 Jun 2026 13:31:53 -0700 (PDT) Received: from TurinLinux.. ([37.19.212.13]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8df7f015805sm11106986d6.1.2026.06.19.13.31.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Jun 2026 13:31:52 -0700 (PDT) From: Nicholas Dudar To: stable@vger.kernel.org Cc: seanjc@google.com, pbonzini@redhat.com, gregkh@linuxfoundation.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, 0wn@theori.io, mlevitsk@redhat.com, jmattson@google.com, Nicholas Dudar Subject: [PATCH v2 6.1.y 0/3] KVM: nVMX: backport virtual-APIC host NULL-deref fix Date: Fri, 19 Jun 2026 16:31:04 -0400 Message-Id: <20260619203107.2752678-1-main.kalliope@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This series backports the fix for a guest-triggerable host NULL pointer dereference in nested-VMX virtual-APIC handling. The bug is present in 6.1.y and fixed in 6.6.y and later. vmx_guest_apic_has_interrupt() tests vmx->nested.virtual_apic_map.gfn to decide the virtual-APIC page is mapped, then reads through vmx->nested.virtual_apic_map.hva. kvm_vcpu_unmap() clears .hva but not .gfn, so after the page is unmapped an L1 guest using virtual-interrupt delivery passes the .gfn check with .hva == NULL and the host faults reading NULL + APIC_PROCPRI (CR2 = 0xa0). 96c66e87deee introduced the .gfn check. The function is still present at 6.1.176. The upstream fix, 321ef62b0c5f, deletes the function. It carries a stable tag but did not apply to 6.1.y. The failed-apply notice [1] lists the SEV-SNP series as a dependency, but that series is not required, and the backport builds fine without it. 321ef62b0c5f edits the vmx_has_nested_events() body that 27c4fa42b11a adds, and 27c4fa42b11a calls pi_find_highest_vector() from d83c36d822be. The series is those three commits in that order. The rest of the June 2024 series is already in 6.1.y. Sean asked for the series to be backported rather than kvm_vcpu_unmap() patched [2]. 6.1.y predates the vmx main.c / x86_ops.h split, so patch 3 removes the hook from vmx_x86_ops in vmx.c. The resulting vmx_has_nested_events() matches 6.6.y. The injection path is unchanged; only the wake path that reached the dereference changes. Reported by Taeyang Lee. [1] https://lore.kernel.org/all/2024072925-straw-mashing-54f6@gregkh [2] https://lore.kernel.org/all/CAH-2XvJo_JiyAnb21_LYxSz8xZ96oUVF25eTnDyALF+wnZw8ww@mail.gmail.com/ Changes since v1: - v1 reached stable@ without this cover letter and with an incomplete Cc, due to a git send-email error on my end. No code changed. Sean Christopherson (3): KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector KVM: nVMX: Check for pending posted interrupts when looking for nested events KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 1 - arch/x86/kvm/vmx/nested.c | 45 +++++++++++++++++++++++++++--- arch/x86/kvm/vmx/posted_intr.h | 10 +++++++ arch/x86/kvm/vmx/vmx.c | 21 -------------- arch/x86/kvm/x86.c | 10 +------ 6 files changed, 52 insertions(+), 36 deletions(-) -- 2.34.1