Re: [PATCH v2 0/3] KVM: SVM: Fix a (very) unlikely UAF for GA Log IRQs

[Sean Christopherson]

On Tue, 30 Jun 2026 14:01:53 -0700, Sean Christopherson wrote:
> Fix a potential UAF due to freeing vCPUs while they're still reachable through
> the global hashed list used to handle GA Log notifications.
> 
> v2:
>  - Defer adding the VM to the GA Log list until a vCPU is created (KVM only
>    needs GA Lot notifications to wake blocking vCPUs), so that removing the
>    VM from the list can be done during pre-destroy without having to handle
>    the scenario where VM creation fails at a later stage. [Sashiko, Xiao]
>  - Drop the stable@ tag, as it's not clear to me that the bug can actually
>    occur in the wild, whereas the changes themselves are somewhat risky.
> 
> [...]

Applied to kvm-x86 svm, and I even remembered to drop the avic_vm_init()
declaration.

[1/3] KVM: SVM: Make kvm_x86_ops.vcpu_precreate() hook fully AVIC specific
      https://github.com/kvm-x86/linux/commit/8b47740b3ae0
[2/3] KVM: SVM: Do all per-VM AVIC initialization during vCPU precreation phase
      https://github.com/kvm-x86/linux/commit/4fa9a3767d1a
[3/3] KVM: SVM: Remove VM from the GA Log notifier list before VM destruction
      https://github.com/kvm-x86/linux/commit/78684b65fcc0

--
https://github.com/kvm-x86/linux/tree/next