This is a note to let you know that I've just added the patch titled KVM: x86: move guest_pv_has out of user_access section to the 5.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: kvm-x86-move-guest_pv_has-out-of-user_access-section.patch and it can be found in the queue-5.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 3e067fd8503d6205aa0c1c8f48f6b209c592d19c Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini@xxxxxxxxxx> Date: Fri, 12 Nov 2021 02:53:41 -0500 Subject: KVM: x86: move guest_pv_has out of user_access section From: Paolo Bonzini <pbonzini@xxxxxxxxxx> commit 3e067fd8503d6205aa0c1c8f48f6b209c592d19c upstream. When UBSAN is enabled, the code emitted for the call to guest_pv_has includes a call to __ubsan_handle_load_invalid_value. objtool complains that this call happens with UACCESS enabled; to avoid the warning, pull the calls to user_access_begin into both arms of the "if" statement, after the check for guest_pv_has. Reported-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> Cc: David Woodhouse <dwmw2@xxxxxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kvm/x86.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -3222,9 +3222,6 @@ static void record_steal_time(struct kvm } st = (struct kvm_steal_time __user *)ghc->hva; - if (!user_access_begin(st, sizeof(*st))) - return; - /* * Doing a TLB flush here, on the guest's behalf, can avoid * expensive IPIs. @@ -3233,6 +3230,9 @@ static void record_steal_time(struct kvm u8 st_preempted = 0; int err = -EFAULT; + if (!user_access_begin(st, sizeof(*st))) + return; + asm volatile("1: xchgb %0, %2\n" "xor %1, %1\n" "2:\n" @@ -3255,6 +3255,9 @@ static void record_steal_time(struct kvm if (!user_access_begin(st, sizeof(*st))) goto dirty; } else { + if (!user_access_begin(st, sizeof(*st))) + return; + unsafe_put_user(0, &st->preempted, out); vcpu->arch.st.preempted = 0; } Patches currently in stable-queue which might be from pbonzini@xxxxxxxxxx are queue-5.14/kvm-vmx-unregister-posted-interrupt-wakeup-handler-on-hardware-unsetup.patch queue-5.14/selftests-kvm-fix-mismatched-fclose-after-popen.patch queue-5.14/kvm-selftests-fix-nested-svm-tests-when-built-with-c.patch queue-5.14/kvm-nvmx-handle-dynamic-msr-intercept-toggling.patch queue-5.14/kvm-nvmx-query-current-vmcs-when-determining-if-msr-bitmaps-are-in-use.patch queue-5.14/x86-irq-ensure-pi-wakeup-handler-is-unregistered-before-module-unload.patch queue-5.14/kvm-x86-move-guest_pv_has-out-of-user_access-section.patch queue-5.14/kvm-x86-fix-recording-of-guest-steal-time-preempted-status.patch queue-5.14/kvm-x86-add-helper-to-consolidate-core-logic-of-set_cpuid-2-flows.patch