Merge tag 'kvm-x86-misc-7.3' of https://github.com/kvm-x86/linux into HEAD

KVM x86 misc changes for 7.3

 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.

 - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.

 - Fix a variety of #DB priority bugs.

 - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.

 - Use static calls for nested virtualization ops.

 - Move more KVM-internal code out of x86's kvm_host.h.

 - Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.

 - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.

 - Harden kvm_vcpu_map() against double-mapping and thus leaking references.

 - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.

1 files changed, 11 insertions, 0 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 43911b8ff00b..65eb26a0520d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3119,6 +3119,9 @@ int __kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
 		.pin = true,
 	};
 
+	if (WARN_ON_ONCE(map->hva))
+		kvm_vcpu_unmap(vcpu, map);
+
 	map->pinned_page = NULL;
 	map->page = NULL;
 	map->hva = NULL;
@@ -4195,6 +4198,8 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, unsigned long id)
 		goto vcpu_decrement;
 	}
 
+	vcpu->vcpu_idx = -1;
+
 	BUILD_BUG_ON(sizeof(struct kvm_run) > PAGE_SIZE);
 	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
 	if (!page) {
@@ -4223,6 +4228,11 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, unsigned long id)
 		goto unlock_vcpu_destroy;
 	}
 
+	/*
+	 * Set the vCPU's index *before* the vCPU is reachable by other tasks.
+	 * Unwind the index back to -1 on failure so that KVM can use the index
+	 * to detect that the vCPU is unreachable, e.g. for lockdep asserts.
+	 */
 	vcpu->vcpu_idx = atomic_read(&kvm->online_vcpus);
 	r = xa_insert(&kvm->vcpu_array, vcpu->vcpu_idx, vcpu, GFP_KERNEL_ACCOUNT);
 	WARN_ON_ONCE(r == -EBUSY);
@@ -4261,6 +4271,7 @@ kvm_put_xa_erase:
 	kvm_put_kvm_no_destroy(kvm);
 	xa_erase(&kvm->vcpu_array, vcpu->vcpu_idx);
 unlock_vcpu_destroy:
+	vcpu->vcpu_idx = -1;
 	mutex_unlock(&kvm->lock);
 	kvm_dirty_ring_free(&vcpu->dirty_ring);
 arch_vcpu_destroy: