linux-kernel - Re: [PATCH v4 28/28] KVM: TDX: Fix list_add corruption during vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <941fbea17cd11f927007b9a805de66a3e984f08f.camel@intel.com>
Date: Thu, 30 Oct 2025 23:12:36 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "chenhuacai@...nel.org" <chenhuacai@...nel.org>, "frankja@...ux.ibm.com"
	<frankja@...ux.ibm.com>, "maz@...nel.org" <maz@...nel.org>,
	"borntraeger@...ux.ibm.com" <borntraeger@...ux.ibm.com>, "pjw@...nel.org"
	<pjw@...nel.org>, "aou@...s.berkeley.edu" <aou@...s.berkeley.edu>,
	"kas@...nel.org" <kas@...nel.org>, "seanjc@...gle.com" <seanjc@...gle.com>,
	"maobibo@...ngson.cn" <maobibo@...ngson.cn>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "maddy@...ux.ibm.com" <maddy@...ux.ibm.com>,
	"palmer@...belt.com" <palmer@...belt.com>, "imbrenda@...ux.ibm.com"
	<imbrenda@...ux.ibm.com>, "zhaotianrui@...ngson.cn"
	<zhaotianrui@...ngson.cn>, "anup@...infault.org" <anup@...infault.org>,
	"oliver.upton@...ux.dev" <oliver.upton@...ux.dev>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "linux-coco@...ts.linux.dev"
	<linux-coco@...ts.linux.dev>, "Zhao, Yan Y" <yan.y.zhao@...el.com>,
	"michael.roth@....com" <michael.roth@....com>, "binbin.wu@...ux.intel.com"
	<binbin.wu@...ux.intel.com>, "Weiny, Ira" <ira.weiny@...el.com>,
	"loongarch@...ts.linux.dev" <loongarch@...ts.linux.dev>,
	"ackerleytng@...gle.com" <ackerleytng@...gle.com>, "kvmarm@...ts.linux.dev"
	<kvmarm@...ts.linux.dev>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "kvm-riscv@...ts.infradead.org"
	<kvm-riscv@...ts.infradead.org>, "Annapurve, Vishal" <vannapurve@...gle.com>,
	"linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-mips@...r.kernel.org"
	<linux-mips@...r.kernel.org>, "Edgecombe, Rick P"
	<rick.p.edgecombe@...el.com>, "linux-riscv@...ts.infradead.org"
	<linux-riscv@...ts.infradead.org>, "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH v4 28/28] KVM: TDX: Fix list_add corruption during
 vcpu_load()

On Thu, 2025-10-30 at 13:09 -0700, Sean Christopherson wrote:
> From: Yan Zhao <yan.y.zhao@...el.com>
> 
> During vCPU creation, a vCPU may be destroyed immediately after
> kvm_arch_vcpu_create() (e.g., due to vCPU id confiliction). However, the
> vcpu_load() inside kvm_arch_vcpu_create() may have associate the vCPU to
> pCPU via "list_add(&tdx->cpu_list, &per_cpu(associated_tdvcpus, cpu))"
> before invoking tdx_vcpu_free().
> 
> Though there's no need to invoke tdh_vp_flush() on the vCPU, failing to
> dissociate the vCPU from pCPU (i.e., "list_del(&to_tdx(vcpu)->cpu_list)")
> will cause list corruption of the per-pCPU list associated_tdvcpus.
> 
> Then, a later list_add() during vcpu_load() would detect list corruption
> and print calltrace as shown below.
> 
> Dissociate a vCPU from its associated pCPU in tdx_vcpu_free() for the vCPUs
> destroyed immediately after creation which must be in
> VCPU_TD_STATE_UNINITIALIZED state.
> 
> kernel BUG at lib/list_debug.c:29!
> Oops: invalid opcode: 0000 [#2] SMP NOPTI
> RIP: 0010:__list_add_valid_or_report+0x82/0xd0
> 
> Call Trace:
>  <TASK>
>  tdx_vcpu_load+0xa8/0x120
>  vt_vcpu_load+0x25/0x30
>  kvm_arch_vcpu_load+0x81/0x300
>  vcpu_load+0x55/0x90
>  kvm_arch_vcpu_create+0x24f/0x330
>  kvm_vm_ioctl_create_vcpu+0x1b1/0x53
>  kvm_vm_ioctl+0xc2/0xa60
>   __x64_sys_ioctl+0x9a/0xf0
>  x64_sys_call+0x10ee/0x20d0
>  do_syscall_64+0xc3/0x470
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: d789fa6efac9 ("KVM: TDX: Handle vCPU dissociation")
> Signed-off-by: Yan Zhao <yan.y.zhao@...el.com>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Kai Huang <kai.huang@...el.com>