)]}'
{
  "commit": "a87b591aba20e05799cce15bd37bcaeb7adc682e",
  "tree": "e3f2e419b0c92eb8a778fa367f932df77515f08b",
  "parents": [
    "e6bcea4bc13acfe8bb9c88cc70784179495c68da"
  ],
  "author": {
    "name": "Manuel Andreas",
    "email": "manuel.andreas@tum.de",
    "time": "Thu Aug 14 17:25:21 2025 -0700"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Fri Sep 05 16:28:45 2025 -0700"
  },
  "message": "KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush\n\n[ Upstream commit fa787ac07b3ceb56dd88a62d1866038498e96230 ]\n\nIn KVM guests with Hyper-V hypercalls enabled, the hypercalls\nHVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX\nallow a guest to request invalidation of portions of a virtual TLB.\nFor this, the hypercall parameter includes a list of GVAs that are supposed\nto be invalidated.\n\nHowever, when non-canonical GVAs are passed, there is currently no\nfiltering in place and they are eventually passed to checked invocations of\nINVVPID on Intel / INVLPGA on AMD.  While AMD\u0027s INVLPGA silently ignores\nnon-canonical addresses (effectively a no-op), Intel\u0027s INVVPID explicitly\nsignals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():\n\n  invvpid failed: ext\u003d0x0 vpid\u003d1 gva\u003d0xaaaaaaaaaaaaa000\n  WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482\n  invvpid_error+0x91/0xa0 [kvm_intel]\n  Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse\n  CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary)\n  RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel]\n  Call Trace:\n    vmx_flush_tlb_gva+0x320/0x490 [kvm_intel]\n    kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm]\n    kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]\n\nHyper-V documents that invalid GVAs (those that are beyond a partition\u0027s\nGVA space) are to be ignored.  While not completely clear whether this\nruling also applies to non-canonical GVAs, it is likely fine to make that\nassumption, and manual testing on Azure confirms \"real\" Hyper-V interprets\nthe specification in the same way.\n\nSkip non-canonical GVAs when processing the list of address to avoid\ntripping the INVVPID failure.  Alternatively, KVM could filter out \"bad\"\nGVAs before inserting into the FIFO, but practically speaking the only\ndownside of pushing validation to the final processing is that doing so\nis suboptimal for the guest, and no well-behaved guest will request TLB\nflushes for non-canonical addresses.\n\nBUG\u003db/441916311\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-38351 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 260970862c88 (\"KVM: x86: hyper-v: Handle HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST{,EX} calls gently\")\nCc: stable@vger.kernel.org\nChange-Id: I1274a3b850fca59f4d66530ed708955654b875f4\nSigned-off-by: Manuel Andreas \u003cmanuel.andreas@tum.de\u003e\nSuggested-by: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nLink: https://lore.kernel.org/r/c090efb3-ef82-499f-a5e0-360fc8420fb7@tum.de\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\n[sean: use plain is_noncanonical_address()]\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/110682\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Shuo Yang \u003cgshuoy@google.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bd3fbd5be5da6ec89b4d52b0da69daa2c04a36e2",
      "old_mode": 33188,
      "old_path": "arch/x86/kvm/hyperv.c",
      "new_id": "223f4fa6a849b8eed1eed0211cd5faab809a042e",
      "new_mode": 33188,
      "new_path": "arch/x86/kvm/hyperv.c"
    }
  ]
}