Re: [PATCH RFC v3 09/21] loongarch: kvm: remove stack copy address of pXd in pXd_offset()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `pud_leaf()` / huge page check before traversing to PMD level, causing invalid memory dereference on 1GB huge pages.
--

commit 7df2ea4ead6f791e1840ca23d67765ca06e93e1b
Author: Yeoreum Yun <yeoreum.yun@arm.com>

loongarch: kvm: remove stack copy address of pXd in pXd_offset()

This commit refactors host_pfn_mapping_level() to prepare for generic
compile-time folded page tables. It replaces direct uses of stack-based pXd
values with pXd_offset_lockless(), passing the pointers directly.

> diff --git a/arch/loongarch/kvm/mmu.c b/arch/loongarch/kvm/mmu.c
> index e104897aa5328..837b40bb694f4 100644
> --- a/arch/loongarch/kvm/mmu.c
> +++ b/arch/loongarch/kvm/mmu.c
[ ... ]
> @@ -698,19 +698,23 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,
[ ... ]
> -	pud = pudp_get(pud_offset(&p4d, hva));
> +	pudp = pud_offset_lockless(p4dp, p4d, hva);
> +	pud = pudp_get(pudp);
>  	if (pud_none(pud) || !pud_present(pud))
>  		goto out;
>  
> -	pmd = pmdp_get(pmd_offset(&pud, hva));
> +	pmdp = pmd_offset_lockless(pudp, pud, hva);
> +	pmd = pmdp_get(pmdp);

[Severity: High]
This is a pre-existing issue, but does this code need a check to see if the
PUD is a leaf entry before stepping down to the PMD level?

In arch/loongarch/kvm/mmu.c:host_pfn_mapping_level(), the code reads the PUD
entry and verifies that it is present, but it does not check if it is a 1GB
huge page leaf entry before traversing to the PMD level.

If a guest memory region is backed by a 1GB huge page on the host, the PUD
entry will contain a PFN-encoded value and metadata flags. By unconditionally
passing this to pmd_offset_lockless(), the macro may interpret the PFN encoded
value as a kernel virtual address directory pointer. This produces a bogus
pointer that pmdp_get() will then dereference, causing an invalid memory
dereference and potentially crashing the host.

Could a pud_leaf() or kvm_pte_huge(pud_val(pud)) check be added before the
pmd_offset_lockless() call to prevent this crash when 1GB huge pages are
used?

>  	if (pmd_none(pmd) || !pmd_present(pmd))
>  		goto out;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-dummy_ptxp3-v3-0-5d8f5b17c25c@arm.com?part=9