Re: [PATCH v2 02/12] KVM: arm64: guest_memfd: Check mmap support when preparing memslot

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] KVM: arm64: mmap check bypassed in
  kvm_arch_prepare_memory_region()
--

commit 30a76d4c8b8b8454f9d59879df7f0b5de9a2cdbb
Author: Steven Price <steven.price@arm.com>

KVM: arm64: guest_memfd: Check mmap support when preparing memslot

This commit adds kvm_gmem_slot_supports_mmap() and updates
kvm_arch_prepare_memory_region() to check whether the guest_memfd backing
file supports mmap rather than checking kvm_memslot_is_gmem_only().

> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 1db10d8d6db73..a146f6cde3d02 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -2839,10 +2839,11 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
>  		return -EFAULT;
>  
>  	/*
> -	 * Only support guest_memfd backed memslots with mappable memory, since
> -	 * there aren't any CoCo VMs that support only private memory on arm64.
> +	 * Protected VMs currently require guest_memfd backed memslots with
> +	 * mappable memory to support shared mappings.
>  	 */
> -	if (kvm_slot_has_gmem(new) && !kvm_memslot_is_gmem_only(new))
> +	if (kvm_arch_has_private_mem(kvm) && kvm_slot_has_gmem(new) &&
> +	    !kvm_gmem_slot_supports_mmap(new))
>  		return -EINVAL;

[Severity: Medium]
Does gating this check on kvm_arch_has_private_mem(kvm) cause a
regression that allows binding non-mappable guest_memfds to non-Realm VMs
on arm64?

At this commit kvm_arch_has_private_mem(kvm) resolves to the stub in
include/linux/kvm_host.h that unconditionally returns false, and even
after commit "KVM: arm64: CCA: Prevent memslot modifications after Realm
creation" defines it as kvm_vm_is_realm(kvm), it remains false for all
non-Realm VMs.

Userspace can then create a guest_memfd without GUEST_MEMFD_FLAG_MMAP and
bind it to a normal VM via KVM_SET_USER_MEMORY_REGION2.  Stage-2 faults
in kvm_vm_mem_abort() -> gmem_abort() will fault those unmappable pages
into the guest while HVA-based KVM accesses via slot->userspace_addr
(such as kvm_read_guest() and kvm_write_guest()) access unrelated VMA
memory.  Dropping the kvm_arch_has_private_mem(kvm) condition here would
preserve the requirement across all arm64 VMs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111145758.217946-1-steven.price@arm.com?part=2