In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Get rid of userspaceirqchipinuse Improper use of userspaceirqchipinuse led to syzbot hitting the following WARNON() in kvmtimerupdateirq(): WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/archtimer.c:459 kvmtimerupdateirq+0x21c/0x394 Call trace: kvmtimerupdateirq+0x21c/0x394 arch/arm64/kvm/archtimer.c:459 kvmtimervcpureset+0x158/0x684 arch/arm64/kvm/archtimer.c:968 kvmresetvcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvmvcpusettarget arch/arm64/kvm/arm.c:1553 [inline] kvmarchvcpuioctlvcpuinit arch/arm64/kvm/arm.c:1573 [inline] kvmarchvcpuioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvmvcpuioctl+0x4ec/0xf74 virt/kvm/kvmmain.c:4658 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:907 [inline] _sesysioctl fs/ioctl.c:893 [inline] _arm64sysioctl+0x108/0x184 fs/ioctl.c:893 _invokesyscall arch/arm64/kernel/syscall.c:35 [inline] invokesyscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0svccommon+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 doel0svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t64synchandler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t64sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVMARMVCPUPMUV3 during KVMARMVCPUINIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVMRUN on the vCPU. Since the vPMU is requested, but not setup, kvmarmpmuv3enable() fails in kvmarchvcpurunpidchange(). As a result, KVMRUN returns after enabling the timer, but before incrementing 'userspaceirqchipinuse': kvmarchvcpurunpidchange() ret = kvmarmpmuv3enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchipinkernel(kvm)) staticbranchinc(&userspaceirqchipinuse); - Userspace ignores the error and issues KVMARMVCPUINIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARNON(): kvmtimervcpureset() if (timer->enabled) kvmtimerupdateirq() if (!userspaceirqchip()) ret = kvmvgicinjectirq() ret = vgiclazyinit() if (unlikely(!vgicinitialized(kvm))) if (kvm->arch.vgic.vgicmodel != KVMDEVTYPEARMVGICV2) return -EBUSY; WARNON(ret); Theoretically, since userspaceirqchipinuse's functionality can be simply replaced by '!irqchipin_kernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-18.18", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-lib-rust-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-extra-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu6-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu7-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-iwlwifi-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-usbio-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-vision-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-buildinfo-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-cloud-tools-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-headers-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws-dbgsym" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-extra-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-tools-6.11.0-1009-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-cloud-tools-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-iwlwifi-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-cloud-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-iwlwifi-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-headers-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-tools-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1008.8", "binary_name": "linux-buildinfo-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-headers-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi-dbgsym" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-modules-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-headers-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-tools-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-tools-6.11.0-1008-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1005.5", "binary_name": "linux-buildinfo-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-cloud-tools-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-headers-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime-dbgsym" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-extra-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-iwlwifi-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-cloud-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-headers-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-tools-6.11.0-1005-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-tools-6.11.0-17-generic" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-cloud-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-extra-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu6-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu7-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-iwlwifi-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-usbio-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-vision-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1015.15", "binary_name": "linux-buildinfo-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-headers-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-image-unsigned-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-image-unsigned-6.11.0-1015-oem-dbgsym" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-ipu6-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-ipu7-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-iwlwifi-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-usbio-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-modules-vision-6.11.0-1015-oem" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-oem-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-oem-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15", "binary_name": "linux-tools-6.11.0-1015-oem" } ] }