From: Sean Christopherson <seanjc@google.com>
To: Ethan Yang <ethan.yang.kernel@gmail.com>
Cc: kvm@vger.kernel.org, xiaoyao.li@intel.com, pbonzini@redhat.com,
syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
x86@kernel.org, tglx@kernel.org, mingo@redhat.com, bp@alien8.de,
dave.hansen@linux.intel.com, hpa@zytor.com, glider@google.com
Subject: Re: [PATCH v2] KVM: x86: Don't leave APF half-enabled on bad APF data GPA
Date: Mon, 6 Apr 2026 09:18:47 -0700 [thread overview]
Message-ID: <adPc51OyKMdkU4pc@google.com> (raw)
In-Reply-To: <20260403100119.3311-1-ethan.yang.kernel@gmail.com>
Thanks for posting this! My "week" estimate was wee bit off...
On Fri, Apr 03, 2026, Ethan Yang wrote:
> static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu)
> @@ -3616,6 +3621,7 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
> {
> gpa_t gpa = data & ~0x3f;
> + bool enable;
>
> /* Bits 4:5 are reserved, Should be zero */
> if (data & 0x30)
> @@ -3632,18 +3638,20 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
> if (!lapic_in_kernel(vcpu))
> return data ? 1 : 0;
>
> + enable = __kvm_pv_async_pf_enabled(data);
> +
> + if (enable &&
> + kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> + sizeof(u64)))
I would rather forgo a local variable and either hhave the below check stay as
kvm_pv_async_pf_enabled() or just redo the call to __kvm_pv_async_pf_enabled().
> + return 1;
Newline please.
> vcpu->arch.apf.msr_en_val = data;
>
> - if (!kvm_pv_async_pf_enabled(vcpu)) {
> + if (!enable) {
> kvm_clear_async_pf_completion_queue(vcpu);
> kvm_async_pf_hash_reset(vcpu);
> return 0;
> }
>
> - if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> - sizeof(u64)))
> - return 1;
> -
> vcpu->arch.apf.send_always = (data & KVM_ASYNC_PF_SEND_ALWAYS);
> vcpu->arch.apf.delivery_as_pf_vmexit = data & KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT;
As I sketched out, in a follow-up patch, I would like to to update these fields
as well. I don't like tracking stale information, even if it _should_ be unused.
Actually, even better, just drop the fields. That way zeroing msr_en_val via
INIT won't lead to stale data either.
I'll post a v3, should be easier overall than posting diffs for the suggestions
and then making you write changelogs :-)
prev parent reply other threads:[~2026-04-06 16:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-16 5:05 [syzbot] [kvm?] WARNING in kvm_read_guest_offset_cached syzbot
2025-07-16 15:23 ` Sean Christopherson
2026-02-10 9:21 ` Alexander Potapenko
2026-02-26 1:47 ` Sean Christopherson
2026-04-03 3:11 ` [PATCH] KVM: x86: Don't leave APF half-enabled on bad APF data GPA Ethan Yang
2026-04-03 8:11 ` Xiaoyao Li
2026-04-03 10:01 ` [PATCH v2] " Ethan Yang
2026-04-06 16:18 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=adPc51OyKMdkU4pc@google.com \
--to=seanjc@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=ethan.yang.kernel@gmail.com \
--cc=glider@google.com \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.