Commit 51938dfa8a51 for kernel

commit 51938dfa8a51a4f85328413fca9b6e21f9d2d088
Author: Amit Machhiwal <amachhiw@linux.ibm.com>
Date:   Tue Sep 15 22:04:15 2026 +0530

    KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

    kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
    mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
    reference on the kvm_nested_guest pointer obtained from the IDR.  A
    concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
    through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
    --refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
    the iterating vCPU with a dangling pointer.  The subsequent
    mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
    gp->shadow_lpid and gp->l1_host all touch freed memory.  The free path
    is fully L1-controlled.

    Fix this by incrementing gp->refcnt inside the loop before dropping
    mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
    reference with kvmhv_put_nested() after the per-guest work completes.
    This is the same get/put discipline already used at every other
    call site that drops mmu_lock while holding a nested-guest pointer.

    Fixes: e3b6b4661527 ("KVM: PPC: Book3S HV: Implement H_TLB_INVALIDATE hcall")
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
    Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
    Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/kvm/book3s_hv_nested.c b/arch/powerpc/kvm/book3s_hv_nested.c
index 22e616662255..a6ff42d7666c 100644
--- a/arch/powerpc/kvm/book3s_hv_nested.c
+++ b/arch/powerpc/kvm/book3s_hv_nested.c
@@ -1204,8 +1204,10 @@ static void kvmhv_emulate_tlbie_all_lpid(struct kvm_vcpu *vcpu, int ric)

 	spin_lock(&kvm->mmu_lock);
 	idr_for_each_entry(&kvm->arch.kvm_nested_guest_idr, gp, lpid) {
+		++gp->refcnt;
 		spin_unlock(&kvm->mmu_lock);
 		kvmhv_emulate_tlbie_lpid(vcpu, gp, ric);
+		kvmhv_put_nested(gp);
 		spin_lock(&kvm->mmu_lock);
 	}
 	spin_unlock(&kvm->mmu_lock);