public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Sean Christopherson <seanjc@google.com>
To: Ethan Yang <ethan.yang.kernel@gmail.com>
Cc: kvm@vger.kernel.org, xiaoyao.li@intel.com, pbonzini@redhat.com,
	 syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com,
	 linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	x86@kernel.org,  tglx@kernel.org, mingo@redhat.com, bp@alien8.de,
	dave.hansen@linux.intel.com,  hpa@zytor.com, glider@google.com
Subject: Re: [PATCH v2] KVM: x86: Don't leave APF half-enabled on bad APF data GPA
Date: Mon, 6 Apr 2026 09:18:47 -0700	[thread overview]
Message-ID: <adPc51OyKMdkU4pc@google.com> (raw)
In-Reply-To: <20260403100119.3311-1-ethan.yang.kernel@gmail.com>

Thanks for posting this!  My "week" estimate was wee bit off...

On Fri, Apr 03, 2026, Ethan Yang wrote:
>  static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu)
> @@ -3616,6 +3621,7 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>  static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
>  {
>  	gpa_t gpa = data & ~0x3f;
> +	bool enable;
>  
>  	/* Bits 4:5 are reserved, Should be zero */
>  	if (data & 0x30)
> @@ -3632,18 +3638,20 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
>  	if (!lapic_in_kernel(vcpu))
>  		return data ? 1 : 0;
>  
> +	enable = __kvm_pv_async_pf_enabled(data);
> +
> +	if (enable &&
> +	    kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> +				      sizeof(u64)))

I would rather forgo a local variable and either hhave the below check stay as
kvm_pv_async_pf_enabled() or just redo the call to __kvm_pv_async_pf_enabled().

> +		return 1;

Newline please.

>  	vcpu->arch.apf.msr_en_val = data;
>  
> -	if (!kvm_pv_async_pf_enabled(vcpu)) {
> +	if (!enable) {
>  		kvm_clear_async_pf_completion_queue(vcpu);
>  		kvm_async_pf_hash_reset(vcpu);
>  		return 0;
>  	}
>  
> -	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> -					sizeof(u64)))
> -		return 1;
> -
>  	vcpu->arch.apf.send_always = (data & KVM_ASYNC_PF_SEND_ALWAYS);
>  	vcpu->arch.apf.delivery_as_pf_vmexit = data & KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT;

As I sketched out, in a follow-up patch, I would like to to update these fields
as well.  I don't like tracking stale information, even if it _should_ be unused.

Actually, even better, just drop the fields.  That way zeroing msr_en_val via
INIT won't lead to stale data either.

I'll post a v3, should be easier overall than posting diffs for the suggestions
and then making you write changelogs :-)


      reply	other threads:[~2026-04-06 16:18 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-07-16  5:05 [syzbot] [kvm?] WARNING in kvm_read_guest_offset_cached syzbot
2025-07-16 15:23 ` Sean Christopherson
2026-02-10  9:21   ` Alexander Potapenko
2026-02-26  1:47     ` Sean Christopherson
2026-04-03  3:11 ` [PATCH] KVM: x86: Don't leave APF half-enabled on bad APF data GPA Ethan Yang
2026-04-03  8:11   ` Xiaoyao Li
2026-04-03 10:01   ` [PATCH v2] " Ethan Yang
2026-04-06 16:18     ` Sean Christopherson [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=adPc51OyKMdkU4pc@google.com \
    --to=seanjc@google.com \
    --cc=bp@alien8.de \
    --cc=dave.hansen@linux.intel.com \
    --cc=ethan.yang.kernel@gmail.com \
    --cc=glider@google.com \
    --cc=hpa@zytor.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@kernel.org \
    --cc=x86@kernel.org \
    --cc=xiaoyao.li@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox