This is a note to let you know that I've just added the patch titled KVM: x86: do not report preemption if the steal time cache is stale to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: kvm-x86-do-not-report-preemption-if-the-steal-time-cache-is-stale.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From c3c28d24d910a746b02f496d190e0e8c6560224b Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini@xxxxxxxxxx> Date: Thu, 4 Aug 2022 15:28:32 +0200 Subject: KVM: x86: do not report preemption if the steal time cache is stale From: Paolo Bonzini <pbonzini@xxxxxxxxxx> commit c3c28d24d910a746b02f496d190e0e8c6560224b upstream. Commit 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status", 2021-11-11) open coded the previous call to kvm_map_gfn, but in doing so it dropped the comparison between the cached guest physical address and the one in the MSR. This cause an incorrect cache hit if the guest modifies the steal time address while the memslots remain the same. This can happen with kexec, in which case the preempted bit is written at the address used by the old kernel instead of the old one. Cc: David Woodhouse <dwmw@xxxxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Fixes: 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status") Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4614,6 +4614,7 @@ static void kvm_steal_time_set_preempted struct kvm_steal_time __user *st; struct kvm_memslots *slots; static const u8 preempted = KVM_VCPU_PREEMPTED; + gpa_t gpa = vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS; /* * The vCPU can be marked preempted if and only if the VM-Exit was on @@ -4641,6 +4642,7 @@ static void kvm_steal_time_set_preempted slots = kvm_memslots(vcpu->kvm); if (unlikely(slots->generation != ghc->generation || + gpa != ghc->gpa || kvm_is_error_hva(ghc->hva) || !ghc->memslot)) return; Patches currently in stable-queue which might be from pbonzini@xxxxxxxxxx are queue-5.18/kvm-x86-tag-kvm_mmu_x86_module_init-with-__init.patch queue-5.18/kvm-put-the-extra-pfn-reference-when-reusing-a-pfn-in-the-gpc-cache.patch queue-5.18/kvm-drop-unused-gpa-param-from-gfn-pfn-cache-s-__release_gpc-helper.patch queue-5.18/kvm-nvmx-let-userspace-set-nvmx-msr-to-any-_host_-supported-value.patch queue-5.18/kvm-x86-do-not-report-preemption-if-the-steal-time-cache-is-stale.patch queue-5.18/kvm-nvmx-inject-ud-if-vmxon-is-attempted-with-incompatible-cr0-cr4.patch queue-5.18/kvm-do-not-incorporate-page-offset-into-gfn-pfn-cache-user-address.patch queue-5.18/kvm-svm-don-t-bug-if-userspace-injects-an-interrupt-with-gif-0.patch queue-5.18/kvm-nvmx-snapshot-pre-vm-enter-bndcfgs-for-nested_run_pending-case.patch queue-5.18/kvm-x86-split-kvm_is_valid_cr4-and-export-only-the-non-vendor-bits.patch queue-5.18/kvm-fix-multiple-races-in-gfn-pfn-cache-refresh.patch queue-5.18/kvm-fully-serialize-gfn-pfn-cache-refresh-via-mutex.patch queue-5.18/kvm-nvmx-account-for-kvm-reserved-cr4-bits-in-consistency-checks.patch queue-5.18/kvm-nvmx-snapshot-pre-vm-enter-debugctl-for-nested_run_pending-case.patch queue-5.18/kvm-x86-revalidate-steal-time-cache-if-msr-value-changes.patch