In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix incorrect FINOEXTENT handling in destroyextentnode()

When destroyextentnode() sets the inode flag FINOEXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388:

F2FS-fs (dm-0): sanitycheckextentcache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix

In the f2fsdropinode path, destroyextentnode() does not need to guarantee that et->nodecnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache.

This patch reverts commit ed78aeebef05 ("f2fs: fix nodecnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->nodecnt.

In the Linux kernel, the following vulnerability has been resolved:

crypto: algifskcipher - force synchronous processing on trees without ctx->state

The AIO/async path in skcipherrecvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After iosubmit() the socket lock is dropped and the request is processed asynchronously, so a concurrent sendmsg(ALGSETIV) can overwrite ctx->iv and make the in-flight request run under an attacker-controlled IV. For CTR/stream modes this is IV/keystream reuse and lets an unprivileged user recover the plaintext of a concurrent operation.

Snapshotting ctx->iv into per-request storage for the async path is not sufficient. For ciphers with statesize == 0 - which includes cbc and ctr - the MSGMORE inter-chunk IV chaining is carried solely by the in-place req->iv writeback, which a snapshot redirects into per-request memory that afalgfreeresources() releases on completion, silently producing wrong output. Writing the IV back from the completion callback instead is not possible either: that would require locksock() there, but the callback can run in softirq/atomic context, so it must not sleep.

Make the operation synchronous instead, which removes both the IV race and any writeback race. This is equivalent to the upstream resolution, commit fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the AIO socket path across net/ entirely and so produces the same end state for this file. This patch deviates from that commit deliberately: rather than removing AIO socket support tree-wide, which would be far too invasive for stable, it removes only the AIO branch in crypto/algifskcipher.c. iosubmit() now completes synchronously; AFALG async is rarely used in practice.

The -EIOCBQUEUED check in skcipherrecvmsg() is now dead but harmless, and is left alone to keep the fix minimal.

Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000 after the change; MSGMORE chunked CTR output bit-identical to single-shot.

In the Linux kernel, the following vulnerability has been resolved:

KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

When marking a page dirty, complain about not having a running/loaded vCPU if and only if the VM is still alive, i.e. its refcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES guests without hitting what is effectively a false positive on the WARN.

For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an exit to userspace, and typically unmaps the page on the next KVMRUN. But if userspace never calls KVMRUN after such an exit, then KVM needs to unmap the page when the vCPU is destroyed, which in turn triggers the WARN about not having a running vCPU.

Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, as is done in nestedvmxfreevcpu() (but for completely unrelated reasons; suppressing WARN from nestedputvmcs12pages() is pure happenstance). But loading a vCPU during destruction is gross (ideally nVMX code would be cleaned up), risks complicating the SEV-ES code (KVM would need to ensure the temporarily load()+put() only runs when the vCPU isn't already loaded), and is ultimately pointless.

The motivation for the WARN is to guard against KVM dirtying guest memory without pushing the corresponding GFN to the active vCPU's dirty ring, e.g. to ensure userspace doesn't miss a dirty page. But for the VM's refcount to reach zero, there can't be any userspace mappings to the dirty ring, as mapping the dirty ring requires doing mmap() on the vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then the vCPU file and thus the owning VM would still be alive. And so since userspace can't possibly reach the dirty ring, whether or not KVM technically "misses" a push to the dirty ring is irrelevant.

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

kvms390giscregister() registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, the function unwinds the pinned pages and other local state, but does not unregister the GISC reference. Add the missing kvms390giscunregister() to the error unwind path.