Syzbot CI

Subject	KVM: Fix+harden against bad uaccess using dying VM
Author	seanjc@google.com
Date	2026-10-30 21:20:49 +0000 UTC
Version
Cc	jmattson@google.com jthoughton@google.com kvm@vger.kernel.org linux-kernel@vger.kernel.org linuxppc-dev@lists.ozlabs.org maddy@linux.ibm.com mason@kernel.org npiggin@gmail.com pbonzini@redhat.com seanjc@google.com

Subject

KVM: Fix+harden against bad uaccess using dying VM

Author

seanjc@google.com

Date

2026-10-30 21:20:49 +0000 UTC

Version

jmattson@google.com jthoughton@google.com kvm@vger.kernel.org linux-kernel@vger.kernel.org linuxppc-dev@lists.ozlabs.org maddy@linux.ibm.com mason@kernel.org npiggin@gmail.com pbonzini@redhat.com seanjc@google.com

Name	Content [All]
[PATCH v4 01/23] KVM: Reject user accesses to guest memory if current->mm != kvm->mm	[Body]
[PATCH v4 02/23] KVM: nVMX: Don't force a full nested VM-Exit when destroying a vCPU	[Body]
[PATCH v4 03/23] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all()	[Body]
[PATCH v4 04/23] KVM: x86: Drop dead check on an existing memslot not having any pages	[Body]
[PATCH v4 05/23] KVM: WARN and error out if memslot update encounters existing slot with no pages	[Body]
[PATCH v4 06/23] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed	[Body]
[PATCH v4 07/23] KVM: x86: Delete non-SMM internal memslot if creating SMM memslot fails	[Body]
[PATCH v4 08/23] KVM: x86: Process all address spaces when deleting internal memslot	[Body]
[PATCH v4 09/23] KVM: x86: Re-queue APICv update request if inhibiting APIC access page fails	[Body]
[PATCH v4 10/23] KVM: x86: Map a separate VMA for each address space for internal memslots	[Body]
[PATCH v4 11/23] KVM: Disallow setting memslots when the VM is being destroyed	[Body]
[PATCH v4 12/23] KVM: Destroy memslots immediately after mmu_notifiers are unregistered	[Body]
[PATCH v4 13/23] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process	[Body]
[PATCH v4 14/23] KVM: WARN and reject guest-based uaccess if VM is dying	[Body]
[PATCH v4 15/23] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory	[Body]
[PATCH v4 16/23] KVM: VMX: Explicility free vmcs01, not the current VMCS, in vCPU free paths	[Body]
[PATCH v4 17/23] KVM: nVMX: Don't explicitly VMCLEAR+free() vmcs01's shadow VMCS when freeing vCPU	[Body]
[PATCH v4 18/23] KVM: nVMX: Cancel the nested VMX Preemption Timer's hrtimer in free_nested()	[Body]
[PATCH v4 19/23] KVM: Add lockdep-only APIs to query and assert that a vCPU is unreachable	[Body]
[PATCH v4 20/23] KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list	[Body]
[PATCH v4 21/23] KVM: nVMX: Don't switch to vmcs01 when freeing a vCPU	[Body]
[PATCH v4 22/23] KVM: nVMX: Don't load+put the vCPU when freeing nested state for a dying vCPU	[Body]
[PATCH v4 23/23] KVM: x86: Rename __x86_set_memory_region() => x86_set_internal_memslot()	[Body]

Name

Content [All]

[PATCH v4 01/23] KVM: Reject user accesses to guest memory if current->mm != kvm->mm

[PATCH v4 02/23] KVM: nVMX: Don't force a full nested VM-Exit when destroying a vCPU

[PATCH v4 03/23] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all()

[PATCH v4 04/23] KVM: x86: Drop dead check on an existing memslot not having any pages

[PATCH v4 05/23] KVM: WARN and error out if memslot update encounters existing slot with no pages

[PATCH v4 06/23] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed

[PATCH v4 07/23] KVM: x86: Delete non-SMM internal memslot if creating SMM memslot fails

[PATCH v4 08/23] KVM: x86: Process all address spaces when deleting internal memslot

[PATCH v4 09/23] KVM: x86: Re-queue APICv update request if inhibiting APIC access page fails

[PATCH v4 10/23] KVM: x86: Map a separate VMA for each address space for internal memslots

[PATCH v4 11/23] KVM: Disallow setting memslots when the VM is being destroyed

[PATCH v4 12/23] KVM: Destroy memslots immediately after mmu_notifiers are unregistered

[PATCH v4 13/23] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process

[PATCH v4 14/23] KVM: WARN and reject guest-based uaccess if VM is dying

[PATCH v4 15/23] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory

[PATCH v4 16/23] KVM: VMX: Explicility free vmcs01, not the current VMCS, in vCPU free paths

[PATCH v4 17/23] KVM: nVMX: Don't explicitly VMCLEAR+free() vmcs01's shadow VMCS when freeing vCPU

[PATCH v4 18/23] KVM: nVMX: Cancel the nested VMX Preemption Timer's hrtimer in free_nested()

[PATCH v4 19/23] KVM: Add lockdep-only APIs to query and assert that a vCPU is unreachable

[PATCH v4 20/23] KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list

[PATCH v4 21/23] KVM: nVMX: Don't switch to vmcs01 when freeing a vCPU

[PATCH v4 22/23] KVM: nVMX: Don't load+put the vCPU when freeing nested state for a dying vCPU

[PATCH v4 23/23] KVM: x86: Rename __x86_set_memory_region() => x86_set_internal_memslot()

Session 2026-10-30

Passed

ID (for dev)	62c718f9-6669-44d8-8e4d-0d9f3e0eb115
Status	finished
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config]		passed [Log]
[KASAN] Boot test: Base	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config]		passed [Log]
[KASAN] Build Patched		7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config] [patched]	passed [Log]
[KASAN] Previous reproducers	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config]	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config] [patched]	passed [Log]
↳ WARNING in __kvm_read_guest_page	passed [Log]	passed [Log]
↳ WARNING in vt_vcpu_pi_remove_from_wakeup_list	passed [Log]	passed [Log]
[KASAN] Fuzz	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config]	7e60162b16f9da0d2fa83da5c1723b6853a0ac1d [Config] [patched]	passed [Log] [Artifacts]

Patches (23)

Series Summary

Sessions

Session 2026-10-30