[5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race

From: Sean Christopherson <seanjc@google.com>

From: Sean Christopherson <seanjc@google.com>

commit 423ecfea77dda83823c71b0fad1c2ddb2af1e5fc upstream.

Make a KVM_REQ_APICV_UPDATE request when creating a vCPU with an
in-kernel local APIC and APICv enabled at the module level.  Consuming
kvm_apicv_activated() and stuffing vcpu->arch.apicv_active directly can
race with __kvm_set_or_clear_apicv_inhibit(), as vCPU creation happens
before the vCPU is fully onlined, i.e. it won't get the request made to
"all" vCPUs.  If APICv is globally inhibited between setting apicv_active
and onlining the vCPU, the vCPU will end up running with APICv enabled
and trigger KVM's sanity check.

Mark APICv as active during vCPU creation if APICv is enabled at the
module level, both to be optimistic about it's final state, e.g. to avoid
additional VMWRITEs on VMX, and because there are likely bugs lurking
since KVM checks apicv_active in multiple vCPU creation paths.  While
keeping the current behavior of consuming kvm_apicv_activated() is
arguably safer from a regression perspective, force apicv_active so that
vCPU creation runs with deterministic state and so that if there are bugs,
they are found sooner than later, i.e. not when some crazy race condition
is hit.

  WARNING: CPU: 0 PID: 484 at arch/x86/kvm/x86.c:9877 vcpu_enter_guest+0x2ae3/0x3ee0 arch/x86/kvm/x86.c:9877
  Modules linked in:
  CPU: 0 PID: 484 Comm: syz-executor361 Not tainted 5.16.13 #2
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1~cloud0 04/01/2014
  RIP: 0010:vcpu_enter_guest+0x2ae3/0x3ee0 arch/x86/kvm/x86.c:9877
  Call Trace:
   <TASK>
   vcpu_run arch/x86/kvm/x86.c:10039 [inline]
   kvm_arch_vcpu_ioctl_run+0x337/0x15e0 arch/x86/kvm/x86.c:10234
   kvm_vcpu_ioctl+0x4d2/0xc80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3727
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:874 [inline]
   __se_sys_ioctl fs/ioctl.c:860 [inline]
   __x64_sys_ioctl+0x16d/0x1d0 fs/ioctl.c:860
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

The bug was hit by a syzkaller spamming VM creation with 2 vCPUs and a
call to KVM_SET_GUEST_DEBUG.

  r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
  r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
  ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000000)) (async)
  r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
  r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x400000000000002)
  ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f00000000c0)={0x5dda9c14aa95f5c5})
  ioctl$KVM_RUN(r2, 0xae80, 0x0)

Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Reported-by: Yongkang Jia <kangel@zju.edu.cn>
Fixes: 8df14af42f00 ("kvm: x86: Add support for dynamic APICv activation")
Cc: stable@vger.kernel.org
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20220420013732.3308816-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c |   15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

Message ID	20220426081753.715426184@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Gaoning Pan <pgn@zju.edu.cn>, Yongkang Jia <kangel@zju.edu.cn>, Maxim Levitsky <mlevitsk@redhat.com>, Sean Christopherson <seanjc@google.com>, Paolo Bonzini <pbonzini@redhat.com> Subject: [PATCH 5.17 130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race Date: Tue, 26 Apr 2022 10:22:05 +0200 Message-Id: <20220426081753.715426184@linuxfoundation.org> In-Reply-To: <20220426081750.051179617@linuxfoundation.org> References: <20220426081750.051179617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/146] perf tools: Fix segfault accessing sample_id xyarray [5.17,003/146] drm/amd/display: Only set PSR version when valid [5.17,004/146] block/compat_ioctl: fix range check in BLKGETSIZE [5.17,005/146] gfs2: assign rgrp glock before compute_bitstructs [5.17,006/146] scsi: ufs: core: scsi_get_lba() error fix [5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.17,008/146] ALSA: usb-audio: Clear MIDI port active flag after draining [5.17,009/146] ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. [5.17,010/146] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.17,011/146] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.17,012/146] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.17,013/146] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.17,014/146] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.17,015/146] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.17,016/146] dmaengine: idxd: fix device cleanup on disable [5.17,017/146] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.17,018/146] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.17,019/146] dmaengine: dw-edma: Fix unaligned 64bit access [5.17,020/146] spi: spi-mtk-nor: initialize spi controller after resume [5.17,021/146] firmware: cs_dsp: Fix overrun of unterminated control name string [5.17,022/146] esp: limit skb_page_frag_refill use to a single page [5.17,023/146] spi: cadence-quadspi: fix incorrect supports_op() return value [5.17,024/146] igc: Fix infinite loop in release_swfw_sync [5.17,025/146] igc: Fix BUG: scheduling while atomic [5.17,026/146] igc: Fix suspending when PTM is active [5.17,027/146] ice: allow creating VFs for !CONFIG_NET_SWITCHDEV [5.17,028/146] ice: fix crash in switchdev mode [5.17,029/146] ice: Fix memory leak in ice_get_orom_civd_data() [5.17,030/146] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.17,031/146] rxrpc: Restore removed timer deletion [5.17,032/146] net/smc: Fix sock leak when release after smc_shutdown() [5.17,033/146] net/packet: fix packet_sock xmit return value checking [5.17,034/146] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.17,035/146] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.17,036/146] net: restore alpha order to Ethernet devices in config [5.17,037/146] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.17,038/146] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.17,039/146] ipv6: make ip6_rt_gc_expire an atomic_t [5.17,040/146] can: isotp: stop timeout monitoring when no first frame was sent [5.17,041/146] net: dsa: hellcreek: Calculate checksums in tagger [5.17,042/146] net: mscc: ocelot: fix broken IP multicast flooding [5.17,043/146] netlink: reset network and mac headers in netlink_dump() [5.17,044/146] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.17,045/146] RISC-V: KVM: Remove s & u as valid ISA extension [5.17,046/146] RISC-V: KVM: Restrict the extensions that can be disabled [5.17,047/146] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.17,048/146] dmaengine: idxd: match type for retries var in idxd_enqcmds() [5.17,049/146] dmaengine: idxd: fix retry value to be constant for duration of function call [5.17,050/146] dmaengine: idxd: add RO check for wq max_batch_size write [5.17,051/146] dmaengine: idxd: add RO check for wq max_transfer_size write [5.17,052/146] dmaengine: idxd: skip clearing device context when device is read-only [5.17,053/146] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.17,054/146] selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets [5.17,055/146] userfaultfd: mark uffd_wp regardless of VM_WRITE flag [5.17,056/146] arm64: mm: fix p?d_leaf() [5.17,057/146] XArray: Disallow sibling entries of nodes [5.17,058/146] drm/msm/gpu: Rename runtime suspend/resume functions [5.17,059/146] drm/msm/gpu: Remove mutex from wait_event condition [5.17,060/146] ARM: vexpress/spc: Avoid negative array index when !SMP [5.17,061/146] reset: renesas: Check return value of reset_control_deassert() [5.17,062/146] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.17,063/146] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.17,064/146] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.17,065/146] drm/msm/disp: check the return value of kzalloc() [5.17,066/146] selftests: KVM: Free the GIC FD when cleaning up in arch_timer [5.17,067/146] ALSA: hda: intel-dsp-config: update AlderLake PCI IDs [5.17,068/146] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.17,069/146] vxlan: fix error return code in vxlan_fdb_append [5.17,070/146] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.17,071/146] net: atlantic: Avoid out-of-bounds indexing [5.17,072/146] mt76: Fix undefined behavior due to shift overflowing the constant [5.17,073/146] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.17,074/146] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.17,075/146] drm/msm/mdp5: check the return of kzalloc() [5.17,076/146] KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU [5.17,077/146] net: macb: Restart tx only if queue pointer is lagging [5.17,078/146] scsi: iscsi: Release endpoint ID when its freed [5.17,079/146] scsi: iscsi: Merge suspend fields [5.17,080/146] scsi: iscsi: Fix NOP handling during conn recovery [5.17,081/146] scsi: qedi: Fix failed disconnect handling [5.17,082/146] stat: fix inconsistency between struct stat and struct compat_stat [5.17,083/146] VFS: filename_create(): fix incorrect intent. [5.17,084/146] nvme: add a quirk to disable namespace identifiers [5.17,085/146] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.17,086/146] nvme-pci: disable namespace identifiers for Qemu controllers [5.17,087/146] irq_work: use kasan_record_aux_stack_noalloc() record callstack [5.17,088/146] EDAC/synopsys: Read the error count from the correct register [5.17,089/146] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.17,090/146] memcg: sync flush only if periodic flush is delayed [5.17,091/146] mm, hugetlb: allow for "high" userspace addresses [5.17,092/146] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.17,093/146] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.17,094/146] ata: pata_marvell: Check the bmdma_addr beforing reading [5.17,095/146] dma: at_xdmac: fix a missing check on list iterator [5.17,096/146] dmaengine: imx-sdma: fix init of uart scripts [5.17,097/146] net: atlantic: invert deep par in pm functions, preventing null derefs [5.17,098/146] drm/radeon: fix logic inversion in radeon_sync_resv [5.17,099/146] io_uring: free iovec if file assignment fails [5.17,100/146] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.17,101/146] scsi: sr: Do not leak information in ioctl [5.17,102/146] sched/pelt: Fix attach_entity_load_avg() corner case [5.17,103/146] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.17,104/146] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.17,105/146] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.17,106/146] powerpc/time: Always set decrementer in timer_interrupt() [5.17,107/146] KVM: PPC: Fix TCE handling for VFIO [5.17,108/146] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.17,109/146] powerpc/perf: Fix power9 event alternatives [5.17,110/146] powerpc/perf: Fix power10 event alternatives [5.17,111/146] arm/xen: Fix some refcount leaks [5.17,112/146] perf script: Always allow field data_src for auxtrace [5.17,113/146] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.17,114/146] fs: fix acl translation [5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts() [5.17,116/146] cifs: use correct lock type in cifs_reconnect() [5.17,117/146] xtensa: patch_text: Fixup last cpu should be master [5.17,118/146] xtensa: fix a7 clobbering in coprocessor context load/store [5.17,119/146] openvswitch: fix OOB access in reserve_sfa_size() [5.17,120/146] gpio: Request interrupts after IRQ is initialized [5.17,121/146] ASoC: rt5682: fix an incorrect NULL check on list iterator [5.17,122/146] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.17,123/146] e1000e: Fix possible overflow in LTR decoding [5.17,124/146] codecs: rt5682s: fix an incorrect NULL check on list iterator [5.17,125/146] ARC: entry: fix syscall_trace_exit argument [5.17,126/146] drm/vmwgfx: Fix gem refcounting and memory evictions [5.17,127/146] arm_pmu: Validate single/group leader events [5.17,128/146] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.17,129/146] KVM: x86: Dont re-acquire SRCU lock in complete_emulated_io() [5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.17,131/146] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.17,132/146] KVM: SVM: Simplify and harden helper to flush SEV guest page(s) [5.17,133/146] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.17,134/146] ext4: fix fallocate to use file_modified to update permissions consistently [5.17,135/146] ext4: fix symlink file size not match to file content [5.17,136/146] ext4: fix use-after-free in ext4_search_dir [5.17,137/146] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.17,138/146] ext4, doc: fix incorrect h_reserved size [5.17,139/146] ext4: fix overhead calculation to account for the reserved gdt blocks [5.17,140/146] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.17,141/146] ext4: update the cached overhead value in the superblock [5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort [5.17,143/146] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.17,144/146] ASoC: SOF: topology: cleanup dailinks on widget unload [5.17,145/146] io_uring: fix leaks on IOPOLL and CQE_SKIP [5.17,146/146] arm64: dts: qcom: add IPA qcom,qmp property

[5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race

Commit Message

Patch