Re: [PATCH RFC v2 09/20] loongarch: kvm: remove stack copy address of pXd in pXd_offset()

[Yeoreum Yun <yeoreum.yun@arm.com>]

On Wed, Jul 22, 2026 at 03:53:25PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Critical] host_pfn_mapping_level() does not check if the PUD entry is a huge page (leaf) before traversing to the PMD level, leading to an unmapped/unaligned address dereference (Host Kernel Panic).
> --
> 
> --- Patch [9]: [PATCH RFC v2 09/20] loongarch: kvm: remove stack copy address of pXd in pXd_offset() ---
> commit 2f6da9236b45d60a4f233dc4f7a63b29a762f060
> Author: Yeoreum Yun <yeoreum.yun@arm.com>
> 
> loongarch: kvm: remove stack copy address of pXd in pXd_offset()
> 
> This commit reworks host_pfn_mapping_level() to avoid using a stack copy
> of a pXd and passes it as an argument to pXd_offset_lockless(). This
> prepares the code for generic compile-time folded page tables.
> 
> > diff --git a/arch/loongarch/kvm/mmu.c b/arch/loongarch/kvm/mmu.c
> > index e104897aa5328..837b40bb694f4 100644
> > --- a/arch/loongarch/kvm/mmu.c
> > +++ b/arch/loongarch/kvm/mmu.c
> 
> [ ... ]
> 
> > @@ -698,19 +698,23 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,
> >  	 * value) and then p*d_offset() walks into the target huge page instead
> >  	 * of the old page table (sees the new value).
> >  	 */
> > -	pgd = pgdp_get(pgd_offset(kvm->mm, hva));
> > +	pgdp = pgd_offset(kvm->mm, hva);
> > +	pgd = pgdp_get(pgdp);
> >  	if (pgd_none(pgd))
> >  		goto out;
> >  
> > -	p4d = p4dp_get(p4d_offset(&pgd, hva));
> > +	p4dp = p4d_offset_lockless(pgdp, pgd, hva);
> > +	p4d = p4dp_get(p4dp);
> >  	if (p4d_none(p4d) || !p4d_present(p4d))
> >  		goto out;
> >  
> > -	pud = pudp_get(pud_offset(&p4d, hva));
> > +	pudp = pud_offset_lockless(p4dp, p4d, hva);
> > +	pud = pudp_get(pudp);
> >  	if (pud_none(pud) || !pud_present(pud))
> >  		goto out;
> >  
> > -	pmd = pmdp_get(pmd_offset(&pud, hva));
> > +	pmdp = pmd_offset_lockless(pudp, pud, hva);
> > +	pmd = pmdp_get(pmdp);
> 
> [Severity: Critical]
> This is a pre-existing issue, but could this cause a host kernel panic if the
> VM is backed by 1GB huge pages (PUD level)?
> 
> In host_pfn_mapping_level(), there does not appear to be a check to see if the
> PUD entry is already a leaf before descending to the PMD level.
> 
> If KVM walks the host page tables and reaches a PUD leaf entry, it seems it
> would pass the PUD leaf directly into pmd_offset_lockless() since there is no
> check similar to kvm_pte_huge() for the PUD. 
> 
> Because the raw PUD entry still contains flag bits like _PAGE_PRESENT and
> _PAGE_HUGE, converting it to a pointer and dereferencing it in pmdp_get() might
> result in an unaligned address dereference, leading to a crash.
> 
> Would it make sense to check if the PUD is a huge page and return the mapping
> level early before trying to resolve the PMD?
> 
> >  	if (pmd_none(pmd) || !pmd_present(pmd))
> >  		goto out;

AFAIK, loongarch doesn't support CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD.
So, the pud_leaf() checking is meaningless.

Therefore, this comment seems ignorable.

-- 
Sincerely,
Yeoreum Yun