$ the-wire · showcase
PowerPC KVM fixes land as Omarchy closes two reset and path bugs
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
Linus pulled the powerpc-7.3-4 fixes, three of which close memory-safety and IOBA overflow bugs in KVM on Book3S HV, while Omarchy shipped a factory-reset change that finally erases root's leftover password hash.
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() torvalds/linux
by Amit Machhiwal
kvmhv_emulate_tlbie_all_lpid() drops mmu_lock before calling kvmhv_emulate_tlbie_lpid() without holding a reference on the kvm_nested_guest pointer it took from the IDR, so a concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can free that guest out from under it via kvmhv_flush_nested() into kvmhv_release_nested() and kfree(). Hosts running nested guests on POWER9 and later take the fix...
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure torvalds/linux
by Amit Machhiwal
In kvmppc_svm_page_in(), a uv_page_in() failure after kvmppc_uvmem_get_page() succeeded leaves the secure device page leaked: the bitmap bit stays set, the GFN stays marked KVMPPC_GFN_UVMEM_PFN, and the goto out_finalize skips the *mig.dst assignment so the page is never returned. This matters on secure-VM hosts where the failure path is reachable repeatedly.
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba torvalds/linux
The TCE unification in b1af23d836f8 left iommu_tce_check_ioba() ignoring its npages argument and validating with a hardcoded 1, so the arithmetic overflow check was skipped for callers using npages > 1, as H_STUFF_TCE and H_PUT_TCE_INDIRECT legitimately do. Restoring npages closes the gap.
Erase old password hashes during factory reset basecamp/omarchy
Factory reset locked root's password but left the hash recoverable in @factory/etc/shadow and shadow-, so the next owner of the machine could read it back; root's password field is now replaced with ! and the account-file backups are removed after the last account update. Cleanup failures abort before boot rebuilding or activation, a failed baseline cleanup restores its read-only flag, and firs...
Refuse hook and state names that are paths basecamp/omarchy
omarchy-hook and omarchy-state set were joining a name straight into a path, so omarchy-hook ../../evil ran ~/.config/evil and omarchy-state set ../../escape created ~/.local/escape; path components are now refused. Adolanium describes it as "a robustness fix, not a security one", since every in-repo caller passes a fixed name.
