Re: [PATCH] KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

[Sean Christopherson <seanjc@google.com>]

On Wed, Sep 30, 2026, Jann Horn wrote:
> On Mon, Aug 10, 2026 at 6:29 PM Sean Christopherson <seanjc@google.com> wrote:
> > On Mon, Aug 10, 2026, Jann Horn wrote:
> > > set_page_dirty() requires that the caller holds some kind of lock to
> > > ensure that the page's mapping does not concurrently go away.
> > > That is not the case for a random page we got from get_user_pages_fast(),
> > > so use set_page_dirty_lock().
> >
> > FWIW, I verified that __kvm_gmem_populate() unlocks the destination folio before
> > post_populate(), so we shouldn't run into deadlock when in-place conversion comes
> > along and userspace does something odd.
> >
> > > Fixes: 97cd21d57e9b ("KVM: SEV: Mark source page dirty when writing back CPUID data on failure")
> > > Signed-off-by: Jann Horn <jannh@google.com>
> > > ---
> > > Note that I have only convinced myself that this is a UAF bug by reading
> > > the source code, and I have only compile-tested this patch; I do not
> > > have SEV-SNP hardware to actually test this.
> > >
> > > This bug was introduced in v7.2-rc1, so if we can get the fix in before
> > > the 7.2 release, this won't require a stable backport.
> >
> > Ya, that would be lovely.  Paolo?
> 
> Ping?
> I still don't see this in mainline or in next.

Ha, I *just* pushed it to kvm-x86/fixes yesterday, it should show up in today's
-next build.

  https://github.com/kvm-x86/linux/commit/9e389110fd668958735141af24d04ed040776235

Oof, but it looks like Paolo force-pushed to kvm/master (accidentally?), so I'll
probably rebase it today.  I.e. the hash is likely going to change (but I'll
still send it along for 7.4).