Re: [PATCH v2 14/18] KVM: arm64: Use noclear for PGD in __pkvm_init_vm error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Using `unmap_donated_memory_noclear()` for the PGD on the error path leaks EL2 virtual addresses to the untrusted host, bypassing hypervisor ASLR.
--

commit d94f8fc664be6ec0ac22803e7fe54acff9cf8af1
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Use noclear for PGD in __pkvm_init_vm error path
    
This commit modifies the error path of __pkvm_init_vm() to use
unmap_donated_memory_noclear() instead of unmap_donated_memory() when
returning the donated stage-2 PGD to the host.

> diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
> index d9ab582268895..0c82f1ddb93df 100644
> --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
> +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
> @@ -861,7 +861,7 @@ int __pkvm_init_vm(struct kvm *host_kvm, unsigned long vm_hva,
>  	kvm_guest_destroy_stage2(hyp_vm);
>  err_remove_mappings:
>  	unmap_donated_memory(hyp_vm, vm_size);
> -	unmap_donated_memory(pgd, pgd_size);
> +	unmap_donated_memory_noclear(pgd, pgd_size);

[Severity: High]
Does using unmap_donated_memory_noclear() here leak EL2 virtual addresses to
the untrusted host?

If the host deliberately provides an invalid handle before triggering this
hypercall, insert_vm_table_entry() will fail and execution will take this
error path.

Before reaching this error path, kvm_guest_prepare_stage2() initializes the
donated PGD memory as a buddy pool. During this process, __hyp_attach_page()
uses page_add_to_list() to write EL2 list_head pointers into the free pages.

By using the noclear variant here, the memory is returned to the host without
zeroing those pointers. The host can then read this returned memory to
extract valid EL2 virtual addresses, which breaks hypervisor KASLR.

Should this remain unmap_donated_memory() to ensure these internal pointers
are properly scrubbed before the host regains access?

>  err_unpin_kvm:
>  	hyp_unpin_shared_mem(host_kvm, host_kvm + 1);
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706175415.2604046-1-vdonnefort@google.com?part=14