Cover Letter Detail
Show a cover letter.
GET /api/covers/2195178/?format=api
{ "id": 2195178, "url": "http://patchwork.ozlabs.org/api/covers/2195178/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/cover/20260210140245.191424-1-massimiliano.pellizzer@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260210140245.191424-1-massimiliano.pellizzer@canonical.com>", "list_archive_url": null, "date": "2026-02-10T14:02:43", "name": "[SRU,J,v2,0/2] CVE-2025-37849", "submitter": { "id": 89057, "url": "http://patchwork.ozlabs.org/api/people/89057/?format=api", "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com" }, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/cover/20260210140245.191424-1-massimiliano.pellizzer@canonical.com/mbox/", "series": [ { "id": 491682, "url": "http://patchwork.ozlabs.org/api/series/491682/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=491682", "date": "2026-02-10T14:02:43", "name": "CVE-2025-37849", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/491682/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/covers/2195178/comments/", "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=iv11keog;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4f9NZS4cyWz1xwH\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 11 Feb 2026 01:03:28 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1vpoKl-0000lZ-G2; Tue, 10 Feb 2026 14:03:19 +0000", "from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <massimiliano.pellizzer@canonical.com>)\n id 1vpoKk-0000lK-5n\n for kernel-team@lists.ubuntu.com; Tue, 10 Feb 2026 14:03:18 +0000", "from mail-wm1-f70.google.com (mail-wm1-f70.google.com\n [209.85.128.70])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 0C5743F12B\n for <kernel-team@lists.ubuntu.com>; Tue, 10 Feb 2026 14:03:18 +0000 (UTC)", "by mail-wm1-f70.google.com with SMTP id\n 5b1f17b1804b1-4832c4621c2so33610865e9.3\n for <kernel-team@lists.ubuntu.com>; Tue, 10 Feb 2026 06:03:18 -0800 (PST)", "from framework (net-93-66-82-32.cust.vodafonedsl.it. [93.66.82.32])\n by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-48320397810sm120995865e9.0.2026.02.10.06.03.15\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 10 Feb 2026 06:03:15 -0800 (PST)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1770732198;\n bh=vfin2ETIcseuf71XmzWzDJxKF7jKrLDGXsr9XSfdkGI=;\n h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type;\n b=iv11keogEp/DH1OW7xJZzKwcSlPZ++1iOXIFO8L7dOrrbL76oOix6LZbv7dVoh8P6\n LOZ20gpkIWPAbyBv80NJE8Gdd/Z8sfnvImiS4PKSNPnnqFHQ3aKPsVLrqAY0JKZ567\n 0yYLrGyRDuVunuNzLLu805+dyA8QiUcy0v93OdWzTzcJ1MRDTM489I3BqXymAvWm4W\n 8Knu4UZuPP4GbrQk4A4999f0BSkA6NxmqMHxQKxl0hJBZakjwdKnXK8Olj9Bmh4oz4\n 61u/Pyjt4QELxvq4X+W4fgSWpkCxikeuziGpwH6mw2ODUa0ibHFCoQCXWjezZdVcrl\n n4rAIL0V21ueAVF9utVo3GvA2TbuPGpFuppSBEYQFg/3ytZTOYYEkhu2F0J+42EjsO\n yTZ9xPuRSXBr8Dj7LT2C7o9LIpQ0a/HaqbfXzxLzbRxdwxFeHbSlNuFi34vwXTgFgW\n qEoxs0YaOe3aRA2p2Q8m2yGQmAO4nUys6NeFfbCv5LOYYhBEA1M5dZS8UZo/kJWicg\n 2zCPlHuFTN8pE2xsiZg3vTjQ9PGcotUurnAw3/fle6bIh3XvmlaCiJ1rYCh5PwQtL9\n 9oWc2bnUoQYnamA8/fNt5kDpZzjVzA0t3ezGqErb+JH0t7EWw9TlDph8HpF4s1X4Wz\n iqm4Pan6sxZVBKeTWv3OjLNA=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1770732197; x=1771336997;\n h=content-transfer-encoding:mime-version:message-id:date:subject:to\n :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=vfin2ETIcseuf71XmzWzDJxKF7jKrLDGXsr9XSfdkGI=;\n b=b9iCh/n2OPd1XYxu4yt+xVZudUfTmZaGgzs2Bl0L03FFZppNNR790Vh11m3yCHu+cU\n aW5RDKOH3n5nwZABMCFlDNrBLEwH7zhD1jEKBvqYponnNsvIOKHk1fbFejO7NeETLgmq\n 096thlBeEyJ7BNa4akIWsqNujYYCo87T0kUE8m53fL/REzAUwHAN7nPrfRKLL62qXZ0V\n Lm0z0MmzQLSs5Gngd86m8tl7EfTS19tUsCzAAu94amEeTrttxpdvK9ObLoQn+nCeF8ol\n onqqbn7sweHNvj3Qsd5t1N1qWrpXsYso3kYVzUqb7+iR/nSZwfoACYQBAEIKjSCgL//b\n g5fg==", "X-Gm-Message-State": "AOJu0YyMPeqINGIrYi+JRMwwzUPMlPEsR7H3kccOg1ZkaSy10f0J6lFx\n 8F+JugaKjQwKrfaTMz054YXsrdDa1acsl/tUCiQQhgJChbfmnTGbpS6g0jYCLBaFnOvuXO0LAaC\n KTjGoauba0rCL+k18UMJHGWlJIzLz4LqtRIAj8QK4CsNpzXIGTSEmApN6sGWIuvQrcs/pne4KjI\n yKdVzq1mkn7QoqgVO7", "X-Gm-Gg": "AZuq6aKvkvMDJYkpdlShh+gd+IH+Vgun5nAQpeE5Ne7GD7hQkBrvD2woT/xGxUMoj9F\n lWAXNtSsES06J9aPA+ZN2ZSXUMqP+PYg5xxRhnc7MPR8s8IbasQsHOW+/IqIYE6Wt92JANA1Kaw\n ZouS4OvJwproe5xsCHz9jahN9yi2gn5yUExiUPI8qez53FwpA7jsIBZzTqqlzvg6zvUpar4jDW0\n 4dLxFItk1DSd0/zx+3sqZJWeXAq27B6zwEYxKHCYWxti9+LUfSOOfbVFe98/TiRTvdGca2aJ8St\n vE6t7DL7ih4ZqVu/3IsTrKXStGZYBmOAnF9C4uX5OfLC/vDU+9ndUXHkEtIMxbK/8DiEZsKy3iP\n krQjlT0OCbrk+70Tv/D9FV2rO2zkp6jvAlYgP/TdIsqEWPZ7RGuTZXkDBgFkH3iOJlTQmeyI8+r\n ZrHgSxKDeFJIfWMF7qL/+6QmX4lIHJLeYL09QMLkFOeVgVP3VVYrfQbdVH9drNCg==", "X-Received": [ "by 2002:a05:600c:8b29:b0:471:1717:411 with SMTP id\n 5b1f17b1804b1-4835081ed4fmr35519205e9.24.1770732197246;\n Tue, 10 Feb 2026 06:03:17 -0800 (PST)", "by 2002:a05:600c:8b29:b0:471:1717:411 with SMTP id\n 5b1f17b1804b1-4835081ed4fmr35518485e9.24.1770732196452;\n Tue, 10 Feb 2026 06:03:16 -0800 (PST)" ], "From": "Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J][PATCH v2 0/2] CVE-2025-37849", "Date": "Tue, 10 Feb 2026 15:02:43 +0100", "Message-ID": "<20260210140245.191424-1-massimiliano.pellizzer@canonical.com>", "X-Mailer": "git-send-email 2.51.0", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "[ Impact ]\n\nKVM: arm64: Tear down vGIC on failed vCPU creation\n\nIf kvm_arch_vcpu_create() fails to share the vCPU page with the\nhypervisor, we propagate the error back to the ioctl but leave the\nvGIC vCPU data initialised. Note only does this leak the corresponding\nmemory when the vCPU is destroyed but it can also lead to use-after-free\nif the redistributor device handling tries to walk into the vCPU.\n\nAdd the missing cleanup to kvm_arch_vcpu_create(), ensuring that the\nvGIC vCPU structures are destroyed on error.\n\n[ Fix ]\n\nBackport the fix commit and a dependency from mainline:\n- d26b9cb33c2d1 KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()\n- 250f25367b58d KVM: arm64: Tear down vGIC on failed vCPU creation\n\n[ Test Plan ]\n\nCompile tested.\nTested on a bare metal arm64 server using:\n* kvm kselftest\n```\n$ uname -a\nLinux puniper 5.15.0-172-generic #182 SMP Tue Feb 10 13:13:39 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux\n$ sudo make summary=1 TARGETS=\"kvm\" kselftest\nTAP version 13\n1..13\n# selftests: kvm: debug-exceptions\nok 1 selftests: kvm: debug-exceptions\n# selftests: kvm: get-reg-list\nok 2 selftests: kvm: get-reg-list\n# selftests: kvm: psci_cpu_on_test\nok 3 selftests: kvm: psci_cpu_on_test\n# selftests: kvm: vgic_init\nok 4 selftests: kvm: vgic_init\n# selftests: kvm: demand_paging_test\nok 5 selftests: kvm: demand_paging_test\n# selftests: kvm: dirty_log_test\nok 6 selftests: kvm: dirty_log_test\n# selftests: kvm: dirty_log_perf_test\nok 7 selftests: kvm: dirty_log_perf_test\n# selftests: kvm: kvm_create_max_vcpus\nok 8 selftests: kvm: kvm_create_max_vcpus\n# selftests: kvm: kvm_page_table_test\nok 9 selftests: kvm: kvm_page_table_test\n# selftests: kvm: rseq_test\nnot ok 10 selftests: kvm: rseq_test # exit=254\n# selftests: kvm: set_memory_region_test\nok 11 selftests: kvm: set_memory_region_test\n# selftests: kvm: steal_time\nok 12 selftests: kvm: steal_time\n# selftests: kvm: kvm_binary_stats_test\nok 13 selftests: kvm: kvm_binary_stats_test\n```\n* kvm unit test\n```\n$ uname -a\nLinux puniper 5.15.0-172-generic #182 SMP Tue Feb 10 13:13:39 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux\n$ sudo ./run_tests.sh\nPASS selftest-setup (2 tests)\nPASS selftest-vectors-kernel (3 tests)\nPASS selftest-vectors-user (2 tests)\nPASS selftest-smp (1 tests)\nPASS pci-test (1 tests)\nPASS pmu-cycle-counter (2 tests)\nPASS pmu-event-introspection (1 tests)\nPASS pmu-event-counter-config (3 tests)\nFAIL pmu-basic-event-count (11 tests, 1 unexpected failures, 1 skipped)\nFAIL pmu-mem-access (3 tests, 2 unexpected failures, 1 skipped)\nPASS pmu-mem-access-reliability (2 tests, 1 skipped)\nPASS pmu-sw-incr (5 tests, 1 skipped)\nFAIL pmu-chained-counters (6 tests, 6 unexpected failures)\nFAIL pmu-chained-sw-incr (2 tests, 2 unexpected failures)\nFAIL pmu-chain-promotion (7 tests, 5 unexpected failures)\nFAIL pmu-overflow-interrupt (7 tests, 3 unexpected failures, 1 skipped)\nSKIP gicv2-ipi (qemu-system-aarch64: host does not support in-kernel GICv2 emulation)\nSKIP gicv2-mmio (qemu-system-aarch64: host does not support in-kernel GICv2 emulation)\nSKIP gicv2-mmio-up (qemu-system-aarch64: host does not support in-kernel GICv2 emulation)\nSKIP gicv2-mmio-3p (qemu-system-aarch64: host does not support in-kernel GICv2 emulation)\nPASS gicv3-ipi (3 tests)\nSKIP gicv2-active (qemu-system-aarch64: host does not support in-kernel GICv2 emulation)\nPASS gicv3-active (1 tests)\nPASS its-introspection (5 tests)\nPASS its-trigger (6 tests)\nPASS its-migration (2 tests)\nPASS its-pending-migration (1 tests)\nPASS its-migrate-unmapped-collection (3 tests)\nPASS psci (5 tests)\nPASS timer (18 tests)\nSKIP micro-bench (test marked as manual run only)\nPASS cache (1 tests)\nPASS debug-bp (16 tests)\nPASS debug-bp-migration (17 tests)\nPASS debug-wp (8 tests)\nPASS debug-wp-migration (9 tests)\nPASS debug-sstep (1 tests)\nPASS debug-sstep-migration (1 tests)\nSKIP fpu-context (test marked as manual run only)\n```\n\nBoth KASAN and PROVE_LOCKING were enabled during the test.\nNotice that all tests failing were failing even before the patchset.\n\n[ Regression Potential ]\n\nThe regression potential is minimal. The patch affects only arm64\nerror path when create_hyp_mappings() fails during vCPU creation.\n\n[ Changes between v1 and v2 ]\n\nBackported also the dependency d26b9cb33c2d1.\n\n\nMarc Zyngierso the dependency (1):\n KVM: arm64: vgic: Add a non-locking primitive for\n kvm_vgic_vcpu_destroy()\n\nWill Deacon (1):\n KVM: arm64: Tear down vGIC on failed vCPU creation\n\n arch/arm64/kvm/arm.c | 6 +++++-\n arch/arm64/kvm/vgic/vgic-init.c | 13 +++++++++++--\n 2 files changed, 16 insertions(+), 3 deletions(-)" }