Re: [PATCH RFC v3 09/21] loongarch: kvm: remove stack copy address of pXd in pXd_offset()

[Yeoreum Yun <yeoreum.yun@arm.com>]

On Wed, Sep 02, 2026 at 12:19:12PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Missing `pud_leaf()` / huge page check before traversing to PMD level, causing invalid memory dereference on 1GB huge pages.
> --
> 
> commit 7df2ea4ead6f791e1840ca23d67765ca06e93e1b
> Author: Yeoreum Yun <yeoreum.yun@arm.com>
> 
> loongarch: kvm: remove stack copy address of pXd in pXd_offset()
> 
> This commit refactors host_pfn_mapping_level() to prepare for generic
> compile-time folded page tables. It replaces direct uses of stack-based pXd
> values with pXd_offset_lockless(), passing the pointers directly.
> 
> > diff --git a/arch/loongarch/kvm/mmu.c b/arch/loongarch/kvm/mmu.c
> > index e104897aa5328..837b40bb694f4 100644
> > --- a/arch/loongarch/kvm/mmu.c
> > +++ b/arch/loongarch/kvm/mmu.c
> [ ... ]
> > @@ -698,19 +698,23 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,
> [ ... ]
> > -	pud = pudp_get(pud_offset(&p4d, hva));
> > +	pudp = pud_offset_lockless(p4dp, p4d, hva);
> > +	pud = pudp_get(pudp);
> >  	if (pud_none(pud) || !pud_present(pud))
> >  		goto out;
> >  
> > -	pmd = pmdp_get(pmd_offset(&pud, hva));
> > +	pmdp = pmd_offset_lockless(pudp, pud, hva);
> > +	pmd = pmdp_get(pmdp);
> 
> [Severity: High]
> This is a pre-existing issue, but does this code need a check to see if the
> PUD is a leaf entry before stepping down to the PMD level?
> 
> In arch/loongarch/kvm/mmu.c:host_pfn_mapping_level(), the code reads the PUD
> entry and verifies that it is present, but it does not check if it is a 1GB
> huge page leaf entry before traversing to the PMD level.
> 
> If a guest memory region is backed by a 1GB huge page on the host, the PUD
> entry will contain a PFN-encoded value and metadata flags. By unconditionally
> passing this to pmd_offset_lockless(), the macro may interpret the PFN encoded
> value as a kernel virtual address directory pointer. This produces a bogus
> pointer that pmdp_get() will then dereference, causing an invalid memory
> dereference and potentially crashing the host.
> 
> Could a pud_leaf() or kvm_pte_huge(pud_val(pud)) check be added before the
> pmd_offset_lockless() call to prevent this crash when 1GB huge pages are
> used?
> 
> >  	if (pmd_none(pmd) || !pmd_present(pmd))
> >  		goto out;

AFAIK, loongarch doesn't create the pud block mapping. so it seems
ignoralbe.

-- 
Sincerely,
Yeoreum Yun