Re: [PATCH v4 00/11] KVM: x86/hyperv: Fix racy usage of vcpu->arch.hyperv

[Sean Christopherson]

On Tue, 30 Jun 2026 15:56:07 -0700, Sean Christopherson wrote:
> Fix a bug found by syzkaller (originally on a Google-internal kernel, but now
> on upstream as well) where KVM consumes a vCPU's HyperV structure before it's
> fully initialized, by concurrently triggering PV TLB flushes (queues flushes
> into a vCPU's FIFO without holding the vCPU's mutex) on a vCPU that is in the
> process of activating HyperV.
> 
> Harden against similar bugs by asserting the vcpu->mutex is held when using
> the "normal" to_hv_vcpu(), same as we did for get_vmcs12() and
> get_shadow_vmcs12() (also in response to cross-task races).  To avoid false
> positives when creating a vCPU, initialize vcpu_idx to -1, and treat the vCPU
> as unreachable (other than the caller, obviously) if its index is -1.
> 
> [...]

Applied to kvm-x86 misc, thanks!

[01/11] KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller
        https://github.com/kvm-x86/linux/commit/d151ca6e1289
[02/11] KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo()
        https://github.com/kvm-x86/linux/commit/b6de8bfdab32
[03/11] KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses
        https://github.com/kvm-x86/linux/commit/c84d86130f24
[04/11] KVM: x86/xen: Always route non-singleshot-timer vCPU hypercalls to userspace
        https://github.com/kvm-x86/linux/commit/e4ffb0ceb9f4
[05/11] KVM: x86/xen: Consolidate checks on Xen vCPU ID for singleshot timer hypercalls
        https://github.com/kvm-x86/linux/commit/32d7943e5179
[06/11] KVM: x86/xen: Punt singleshot timer hcalls to userspace if Xen vCPU ID isn't set
        https://github.com/kvm-x86/linux/commit/c10bd49bdcc9
[07/11] KVM: Initialize a vCPU's index to '-1' while it's being created
        https://github.com/kvm-x86/linux/commit/b29125ead04d
[08/11] KVM: Move nVMX's lockdep logic for vcpu->mutex to a common helper
        https://github.com/kvm-x86/linux/commit/e34be29ecd47
[09/11] KVM: x86: Treat a vCPU as unreachable if its index is invalid
        https://github.com/kvm-x86/linux/commit/c33aef581703
[10/11] KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()
        https://github.com/kvm-x86/linux/commit/53ce2c773f00
[11/11] KVM: x86/hyperv: Use {READ,WRITE}_ONCE for cross-task synic->active accesses
        https://github.com/kvm-x86/linux/commit/09dd4de361dc

--
https://github.com/kvm-x86/linux/tree/next