Re: [PATCH v3] KVM: Skip gfn-based MMU notifier invalidations for guest_memfd-only memslots

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Critical] KVM: x86/mmu: host page UAF via kvm_mmu_prefetch_sptes() on
  gmem-only memslots
--

commit 8fb2cb0acca2cbb14c599c1c5881381eb579d79c
Author: Alexandru Elisei <alexandru.elisei@arm.com>

KVM: Skip gfn-based MMU notifier invalidations for guest_memfd-only memslots

This commit skips guest_memfd-only memslots in kvm_handle_hva_range() when
handling MMU notifier invalidations.

Link: https://lore.kernel.org/all/20260903160623.315525-1-alexandru.elisei@arm.com
Link: https://lore.kernel.org/all/cover.1783490022.git.naveen@kernel.org

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index cf4cb586f1407..599dea22afb81 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -601,6 +601,10 @@ static __always_inline kvm_mn_ret_t kvm_handle_hva_range(struct kvm *kvm,
>  			unsigned long hva_start, hva_end;
>  
>  			slot = container_of(node, struct kvm_memory_slot, hva_node[slots->node_idx]);
> +
> +			if (kvm_slot_has_gmem(slot) && kvm_memslot_is_gmem_only(slot))
> +				continue;

[Severity: Critical]
Can skipping guest_memfd-only memslots here leave writable SPTEs installed by
x86's kvm_mmu_prefetch_sptes() unzapped when the VMA at slot->userspace_addr
is unmapped?

While __kvm_mmu_faultin_pfn() resolves the primary fault from guest_memfd for
gmem-only memslots, the post-fault PTE prefetch paths (such as FNAME(fetch)()
-> FNAME(pte_prefetch)() for nested EPT/NPT or shadow paging) call
kvm_mmu_prefetch_sptes() for neighboring GFNs without checking
kvm_memslot_is_gmem_only():

arch/x86/kvm/mmu/mmu.c:kvm_mmu_prefetch_sptes() {
	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, access & ACC_WRITE_MASK);
	if (!slot)
		return false;

	nr_pages = kvm_prefetch_pages(slot, gfn, pages, nr_pages);
	if (nr_pages <= 0)
		return false;

	for (i = 0; i < nr_pages; i++, gfn++, sptep++) {
		mmu_set_spte(vcpu, slot, sptep, access, gfn,
			     page_to_pfn(pages[i]), NULL);
		...
		kvm_release_page_dirty(pages[i]);
	}
}

kvm_prefetch_pages() resolves PFNs from slot->userspace_addr via
get_user_pages_fast_only(), and kvm_mmu_prefetch_sptes() installs writable
SPTEs and drops the page references.  With kvm_handle_hva_range() ignoring
gmem-only memslots, unmapping or reclaiming the VMA at slot->userspace_addr
will not zap those prefetched SPTEs, giving the guest a host page
use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113164000.467175-1-seanjc@google.com?part=1