Re: [PATCH v2 24/28] KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory attributes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: x86/mmu: inverted condition in kvm_mmu_prefetch_sptes() bypasses memory protections
--

commit 68c32d2a3026b65b5bee3d2be8dae5b6311d03d5
Author: Nicolas Saenz Julienne <nsaenz@amazon.com>

KVM: x86/mmu: Do not prefetch sptes on gfns backed by memory attributes

This commit aims to prevent prefetching GFNs that have memory protections
applied, because prefetched SPTEs are always given full access. It
introduces a check using kvm_get_memory_attributes() to skip prefetching
for such pages.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 3fd4cc3c57a53..097095f71d605 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -3187,6 +3187,11 @@ static bool kvm_mmu_prefetch_sptes(struct kvm_vcpu *vcpu, gfn_t gfn, u64 *sptep,
>  		return false;
>  
>  	for (i = 0; i < nr_pages; i++, gfn++, sptep++) {
> +		if (!kvm_get_memory_attributes(vcpu->kvm, gfn)) {
> +			kvm_release_page_clean(pages[i]);
> +			continue;
> +		}

[Severity: High]
Does this logic invert the intended check?

When a page has no memory attributes, kvm_get_memory_attributes() returns 0,
making the ! condition evaluate to true. This causes normal memory pages to
be skipped, which could lead to performance regressions.

Conversely, if a page does have memory attributes, it returns non-zero, making
the condition false. Could an untrusted guest VM deterministically trigger
page prefetching by faulting on adjacent pages, allowing protected memory
to fall through to mmu_set_spte() and be mapped with full access?

> +
>  		mmu_set_spte(vcpu, slot, sptep, access, gfn,
>  			     page_to_pfn(pages[i]), NULL);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918081543.139871-1-pbonzini@redhat.com?part=24