linux-stable.git/arch, branch master

Merge tag 'powerpc-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2026-07-30T15:24:12+00:00

Pull powerpc fixes from Madhavan Srinivasan:

 - ensure vpa,slb_shadow & dtl are unregistered during crash

 - fix nap return address corruption on async interrupt exit in 970
   platform

 - fix exit_flags field placement in pt_regs for ptrace

 - fix map failure path in dma_ioc0_map_pages() in ps3 platfrom

 - MAINTAINERS: Michael Ellerman demotes himself to reviewer

 - misc fixes and cleanup

Thanks to Amit Machhiwal, Andreas Schwab, Anushree Mathur, Athira
Rajeev, Christophe Leroy (CS GROUP), Dmitry V. Levin, Geert
Uytterhoeven, John Ogness, Michael Ellerman, Mukesh Kumar Chaurasiya
(IBM), Ritesh Harjani (IBM), Thorsten Blum, and Vaibhav Jain

* tag 'powerpc-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  MAINTAINERS: Demote myself to reviewer
  powerpc/serial: Fix include guard comment
  powerpc/perf: Use strstarts() to simplify is_thread_imc_pmu()
  powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
  powerpc/ps3: Remove unused struct table in setup_areas()
  powerpc/boot: Fix treeboot-akebono CPU node lookup check
  powerpc/boot: Fix treeboot-currituck CPU node lookup check
  powerpc/boot: Fix simpleboot CPU node lookup check
  powerpc: Fix exit_flags field placement in pt_regs for ptrace
  powerpc/970: fix nap return address corruption on async interrupt exit
  powerpc/pseries: Skip vpa_init() for boot cpu in smp_setup_cpu()
  powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash

KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

2026-07-29T21:39:36+00:00

Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even
if L2 is active and KVM is using a separate MSR bitmap to run L2.  If AVIC
is fully enabled prior to running L2, and is then inhibited while L2 is
active (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,
but with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of
the host's APIC state, send arbitrary interrupts, change task priority, and
ultimately trivially DoS the host.

E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with
CONFIG_HYPERV=n in the host kernel as a "safe" PoC, yields:

  Spurious interrupt (vector 0xee) on CPU#425. Acked

And hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a
handler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:

  ------------[ cut here ]------------
  WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940
  CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S   U
  Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
  Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026
  RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]
  Call Trace:
   
   sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80
   
   
   asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20
  RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]
   kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]
   kvm_vcpu_ioctl+0x580/0x6b0 [kvm]
   __se_sys_ioctl+0x6d/0xb0
   do_syscall_64+0x10a/0x480
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x46ff4b
   
  ---[ end trace 0000000000000000 ]---

Fixes: 091abbf578f9 ("KVM: x86: nSVM: optimize svm_set_x2apic_msr_interception")
Cc: stable@vger.kernel.org
Cc: Yosry Ahmed 
Signed-off-by: Sean Christopherson 
Link: https://patch.msgid.link/20260729213558.639074-1-pbonzini@redhat.com/
Signed-off-by: Paolo Bonzini

KVM: x86/mmu: Check all address spaces before skipping unsync

2026-07-28T16:07:18+00:00

mmu_try_to_unsync_pages() skips the shadow-page lookup when the
supplied memslot allows a hugepage, because a shadow page would disallow
hugepages.  But hugepage metadata is per-address-space while shadow pages
are shared across all address spaces.  With SMM, the other address space
can therefore have a shadow page even when the supplied memslot allows a
hugepage.

Check the corresponding memslot in the other address space before
taking the fast path.  Skip the shadow-page lookup only when all address
spaces allow a hugepage.

Fixes: b3ae3ceb5569 ("KVM: x86/mmu: KVM: x86/mmu: Skip unsync when large pages are allowed")
Assisted-by: Codex:GPT-5
Signed-off-by: Jinu Kim 
[invert direction of the conditional. - Paolo]
Message-ID: <20260721103512.2136240-3-kimjw04271234@gmail.com>
Signed-off-by: Paolo Bonzini

KVM: x86/mmu: Check write tracking in all address spaces

2026-07-28T16:07:14+00:00

kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces.  With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.

Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space.  In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().

Fixes: 699023e23965 ("KVM: x86: add SMM to the MMU role, support SMRAM address space")
Assisted-by: Codex:GPT-5
Signed-off-by: Jinu Kim 
Message-ID: <20260721103512.2136240-2-kimjw04271234@gmail.com>
[invert direction of the conditional. - Paolo]
Signed-off-by: Paolo Bonzini

KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

2026-07-28T15:43:28+00:00

Cancel (and flush) the I/O APIC's delayed EOI handling work during the
"pre VM destroy" phase, before vCPUs are destroyed, as processing the EOI
broadcast will inject another IRQ if the line is asserted, i.e. will try
to deliver an IRQ to the target vCPU(s).  Canceling the work after vCPUs
are destroyed leads to UAF if the delayed work is processed after vCPUs are
destroyed.

  BUG: KASAN: slab-use-after-free in __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250
  Read of size 8 at addr ffff8880499abea0 by task kworker/1:2/1218

  CPU: 1 UID: 0 PID: 1218 Comm: kworker/1:2 Not tainted 7.1.0-rc7 #5 PREEMPT(lazy)
  Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  Workqueue: events kvm_ioapic_eoi_inject_work
  Call Trace:
   
   __dump_stack lib/dump_stack.c:94
   dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
   print_address_description mm/kasan/report.c:378
   print_report+0x139/0x4ad mm/kasan/report.c:482
   kasan_report+0xe4/0x1d0 mm/kasan/report.c:595
   __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250
   __kvm_irq_delivery_to_apic+0xd8/0xbf0 arch/x86/kvm/lapic.c:1345
   kvm_irq_delivery_to_apic arch/x86/kvm/lapic.h:129
   ioapic_service+0x308/0x590 arch/x86/kvm/ioapic.c:492
   kvm_ioapic_eoi_inject_work+0x13c/0x190 arch/x86/kvm/ioapic.c:532
   process_one_work+0xa59/0x19a0 kernel/workqueue.c:3314
   process_scheduled_works kernel/workqueue.c:3397
   worker_thread+0x5eb/0xe50 kernel/workqueue.c:3478
   kthread+0x370/0x450 kernel/kthread.c:436
   ret_from_fork+0x72b/0xd30 arch/x86/kernel/process.c:158
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   

Note, the VM is unreachable once kvm_destroy_vm() starts, and scheduling
new work via kvm_ioapic_send_eoi() can only be done via KVM_RUN, i.e.
requires a live vCPU.

Alternatively, KVM could simply destroy the I/O APIC during the "pre" phase
of VM destruction, but that gets more than a bit sketchy as KVM expects the
I/O APIC to exist if ioapic_in_kernel() is true, and nested virtualization
in particular has a bad habit of touching VM-scope state during vCPU
destruction.  E.g. attempting to free the PIC during the pre phase would
lead to a NULL pointer dereference in kvm_cpu_has_extint(), and it's not
hard to imagine the I/O APIC having a similar flaw.

Fixes: 17bcd7144263 ("KVM: x86: Free vCPUs before freeing VM state")
Reported-by: 
Reported-by: Zhong Wang 
Reported-by: Xuanqing Shi 
Cc: stable@vger.kernel.org
Signed-off-by: Weiming Shi 
Co-developed-by: Sean Christopherson 
Signed-off-by: Sean Christopherson 
Message-ID: <20260727171718.543491-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini

KVM: VMX: add memory clobber to asm for VMX instructions

2026-07-28T15:43:28+00:00

VMCLEAR/VMREAD/VMWRITE/VMPTRLD access the internal VMCS cache, which
is not visible to the compiler; without a memory clobber, the compiler
can reorder them in troublesome ways because "asm volatile" and "asm goto"
only protect against removal of the asm.  For example, placing a VMWRITE
before the corresponding VMCS pointer is loaded can lead to corruption.
While none of this has been observed, it is better to prevent than cure.

Likewise, INVEPT and INVVPID access the TLB and, even though in their
case the effect is only visible to the next VMLAUNCH/VMRESUME, it is
technically correct to add the clobber there too.  So avoid any urge to
special case them, and simply hardcode "memory" into the clobber list
of vmx_asm1() and vmx_asm2().  __vmcs_readl() open-codes its own asm,
so add the clobber there as well.

Link: https://lore.kernel.org/kvm/CABgObfbL3t21yVeSwiLSjjOUER+rTYDPHYAH9YU4TWGRjx6XHg@mail.gmail.com/
Cc: Sean Christopherson 
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini

Merge tag 'kvmarm-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

2026-07-28T15:43:23+00:00

KVM/arm64 fixes for 7.2, take #3

- Fix a tiny buglet when propagating the deactivation of an interrupt
  from a nested guest, which happened to trigger a gold plated CPU bug
  on a particular implementation

- Fix a race between LPI unmapping and mapping, resulting in leaked
  LPIs

- Make LPI mapping more robust on memory allocation failure

- Fix the handling of the EL2 tracing clock being disabled

- A couple of Sashiko-driven fixes for corner cases in the EL2 tracing
  code

- Add missing sysreg tracepoint for the EL2 code

- Tidy-up the mutual exclusion of guest-memfd and MTE

- Update Fuad's email address to point to @linux.dev

Merge tag 'kvm-s390-master-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

2026-07-28T15:43:18+00:00

KVM: s390: Fixes for 7.2

- several fixes for PCI passthru in s390 kvm
- fix a 7.2-rc regression in the adapter interrupt mapping code

powerpc/serial: Fix include guard comment

2026-07-28T04:53:32+00:00

Replace _PPC64_SERIAL_H with _ASM_POWERPC_SERIAL_H to match the actual
macro name. Remove an empty comment while at it.

Signed-off-by: Thorsten Blum 
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260623153825.403819-2-thorsten.blum@linux.dev

powerpc/perf: Use strstarts() to simplify is_thread_imc_pmu()

2026-07-28T04:53:31+00:00

Replace the open-coded implementation with strstarts() to simplify
is_thread_imc_pmu().

Signed-off-by: Thorsten Blum 
Reviewed-by: Athira Rajeev 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260704121353.201583-3-thorsten.blum@linux.dev