Re: [PATCH v8 09/46] KVM: guest_memfd: Introduce function to check GFN private/shared status

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] `kvm_gmem_is_private()` hardcodes address space 0 by using `gfn_to_memslot(kvm, gfn)`, which breaks multi-address-space vCPUs (e.g., SMM).
--

commit 8dfdb2d13d27c9727b32ecdcb6460d23702e6438
Author: Ackerley Tng <ackerleytng@google.com>

KVM: guest_memfd: Introduce function to check GFN private/shared status

This commit introduces a new KVM utility function to check whether a given
GFN is backed by private memory. It checks for a guest_memfd file associated
with the memslot and queries the inode's private memory state.

> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> index 8101f64e0366f..bca912db5be6e 100644
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c
[ ... ]
> @@ -510,6 +510,37 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
>  	return 0;
>  }
>  
> +bool kvm_gmem_is_private(struct kvm *kvm, gfn_t gfn)
> +{
> +	struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);

[Severity: High]
Does this code correctly handle multi-address-space vCPUs (such as SMM on
x86)?

The call to gfn_to_memslot() internally looks up the memslot tree strictly
for address space 0. If a vCPU is operating in an alternate address space
where the memslot layout differs from address space 0, this lookup could
return an incorrect memslot or no memslot at all.

This could cause KVM to incorrectly treat private memory accesses as shared
for alternate address spaces, potentially leading to incorrect page table
installations or guest memory corruption. Should this function perhaps take
the target kvm_vcpu or the kvm_memory_slot directly so it is evaluated
against the correct address space?

> +	struct inode *inode;
> +
> +	/*
> +	 * If this gfn has no associated memslot, there's no chance of the gfn
> +	 * being backed by private memory, since guest_memfd must be used for
> +	 * private memory, and guest_memfd must be associated with some memslot.
> +	 */
> +	if (!slot)
> +		return 0;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618-gmem-inplace-conversion-v8-0-9d2959357853@google.com?part=9