Re: [PATCH RFC v2 09/20] loongarch: kvm: remove stack copy address of pXd in pXd_offset()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] host_pfn_mapping_level() does not check if the PUD entry is a huge page (leaf) before traversing to the PMD level, leading to an unmapped/unaligned address dereference (Host Kernel Panic).
--

--- Patch [9]: [PATCH RFC v2 09/20] loongarch: kvm: remove stack copy address of pXd in pXd_offset() ---
commit 2f6da9236b45d60a4f233dc4f7a63b29a762f060
Author: Yeoreum Yun <yeoreum.yun@arm.com>

loongarch: kvm: remove stack copy address of pXd in pXd_offset()

This commit reworks host_pfn_mapping_level() to avoid using a stack copy
of a pXd and passes it as an argument to pXd_offset_lockless(). This
prepares the code for generic compile-time folded page tables.

> diff --git a/arch/loongarch/kvm/mmu.c b/arch/loongarch/kvm/mmu.c
> index e104897aa5328..837b40bb694f4 100644
> --- a/arch/loongarch/kvm/mmu.c
> +++ b/arch/loongarch/kvm/mmu.c

[ ... ]

> @@ -698,19 +698,23 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,
>  	 * value) and then p*d_offset() walks into the target huge page instead
>  	 * of the old page table (sees the new value).
>  	 */
> -	pgd = pgdp_get(pgd_offset(kvm->mm, hva));
> +	pgdp = pgd_offset(kvm->mm, hva);
> +	pgd = pgdp_get(pgdp);
>  	if (pgd_none(pgd))
>  		goto out;
>  
> -	p4d = p4dp_get(p4d_offset(&pgd, hva));
> +	p4dp = p4d_offset_lockless(pgdp, pgd, hva);
> +	p4d = p4dp_get(p4dp);
>  	if (p4d_none(p4d) || !p4d_present(p4d))
>  		goto out;
>  
> -	pud = pudp_get(pud_offset(&p4d, hva));
> +	pudp = pud_offset_lockless(p4dp, p4d, hva);
> +	pud = pudp_get(pudp);
>  	if (pud_none(pud) || !pud_present(pud))
>  		goto out;
>  
> -	pmd = pmdp_get(pmd_offset(&pud, hva));
> +	pmdp = pmd_offset_lockless(pudp, pud, hva);
> +	pmd = pmdp_get(pmdp);

[Severity: Critical]
This is a pre-existing issue, but could this cause a host kernel panic if the
VM is backed by 1GB huge pages (PUD level)?

In host_pfn_mapping_level(), there does not appear to be a check to see if the
PUD entry is already a leaf before descending to the PMD level.

If KVM walks the host page tables and reaches a PUD leaf entry, it seems it
would pass the PUD leaf directly into pmd_offset_lockless() since there is no
check similar to kvm_pte_huge() for the PUD. 

Because the raw PUD entry still contains flag bits like _PAGE_PRESENT and
_PAGE_HUGE, converting it to a pointer and dereferencing it in pmdp_get() might
result in an unaligned address dereference, leading to a crash.

Would it make sense to check if the PUD is a huge page and return the mapping
level early before trying to resolve the PMD?

>  	if (pmd_none(pmd) || !pmd_present(pmd))
>  		goto out;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-dummy_ptxp3-v2-0-d9e4bad31e0a@arm.com?part=9