Re: [PATCH v4 15/18] KVM: guest_memfd: Fold __kvm_gmem_prepare_folio() into its sole caller

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch breaks the GPA alignment for huge folios by passing the original, unaligned faulting `gfn` to `kvm_arch_gmem_prepare()`, resulting in a mismatch between the unaligned GPA and the aligned base PFN of the folio.
--

--- Patch [15]: [PATCH v4 15/18] KVM: guest_memfd: Fold __kvm_gmem_prepare_folio() into its sole caller ---
commit 30508b546ec3ffd0655d6bdccee0095661b93a2e
Author: Sean Christopherson <seanjc@google.com>

KVM: guest_memfd: Fold __kvm_gmem_prepare_folio() into its sole caller

This commit folds __kvm_gmem_prepare_folio() into kvm_gmem_prepare_folio(),
extending the #ifdef guard to cover the entirety of the function and
eliminating the tail-call helper.

> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c

[ ... ]

> @@ -82,6 +69,7 @@ static int __kvm_gmem_prepare_folio(struct kvm *kvm, struct kvm_memory_slot *slo
>  static int kvm_gmem_prepare_folio(struct kvm *kvm, struct kvm_memory_slot *slot,
>  				  gfn_t gfn, struct folio *folio)
>  {
> +#ifdef CONFIG_HAVE_KVM_ARCH_GMEM_PREPARE
>  	pgoff_t index;
>  
>  	/*
> @@ -101,7 +89,12 @@ static int kvm_gmem_prepare_folio(struct kvm *kvm, struct kvm_memory_slot *slot,
>  	index = kvm_gmem_get_index(slot, gfn);
>  	index = ALIGN_DOWN(index, folio_nr_pages(folio));
>  
> -	return __kvm_gmem_prepare_folio(kvm, slot, index, folio);
> +	return kvm_arch_gmem_prepare(kvm, gfn_to_gpa(gfn),
> +				     folio_file_pfn(folio, index),
> +				     folio_order(folio));

[Severity: Medium]
When folding this helper, did we lose the GFN alignment for huge folios?

In the old __kvm_gmem_prepare_folio() helper, the gfn was recalculated from
the aligned index:

	gfn_t gfn = slot->base_gfn + index - slot->gmem.pgoff;

By passing the original, unaligned faulting gfn to kvm_arch_gmem_prepare()
alongside the aligned base PFN from folio_file_pfn(), does this create a
mismatch between the unaligned GPA and the aligned base PFN for huge folios?

While guest_memfd currently restricts allocations to order-0 folios, this would
pass an offset GPA with a base PFN to the architecture hooks once huge folios
are supported, violating the API contract and potentially corrupting the guest
mapping (e.g., if a backend like SEV-SNP falls back to 4K mappings for a huge
folio).

> +#else
> +	return 0;
> +#endif
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709204948.1988414-1-seanjc@google.com?part=15