Re: [PATCH v3] KVM: Skip gfn-based MMU notifier invalidations for guest_memfd-only memslots

[Sean Christopherson <seanjc@google.com>]

On Fri, Nov 13, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index cf4cb586f1407..599dea22afb81 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -601,6 +601,10 @@ static __always_inline kvm_mn_ret_t kvm_handle_hva_range(struct kvm *kvm,
> >  			unsigned long hva_start, hva_end;
> >  
> >  			slot = container_of(node, struct kvm_memory_slot, hva_node[slots->node_idx]);
> > +
> > +			if (kvm_slot_has_gmem(slot) && kvm_memslot_is_gmem_only(slot))
> > +				continue;
> 
> [Severity: Critical]
> Can skipping guest_memfd-only memslots here leave writable SPTEs installed by
> x86's kvm_mmu_prefetch_sptes() unzapped when the VMA at slot->userspace_addr
> is unmapped?
> 
> While __kvm_mmu_faultin_pfn() resolves the primary fault from guest_memfd for
> gmem-only memslots, the post-fault PTE prefetch paths (such as FNAME(fetch)()
> -> FNAME(pte_prefetch)() for nested EPT/NPT or shadow paging) call
> kvm_mmu_prefetch_sptes() for neighboring GFNs without checking
> kvm_memslot_is_gmem_only():
> 
> arch/x86/kvm/mmu/mmu.c:kvm_mmu_prefetch_sptes() {
> 	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, access & ACC_WRITE_MASK);
> 	if (!slot)
> 		return false;
> 
> 	nr_pages = kvm_prefetch_pages(slot, gfn, pages, nr_pages);
> 	if (nr_pages <= 0)
> 		return false;
> 
> 	for (i = 0; i < nr_pages; i++, gfn++, sptep++) {
> 		mmu_set_spte(vcpu, slot, sptep, access, gfn,
> 			     page_to_pfn(pages[i]), NULL);
> 		...
> 		kvm_release_page_dirty(pages[i]);
> 	}
> }
> 
> kvm_prefetch_pages() resolves PFNs from slot->userspace_addr via
> get_user_pages_fast_only(), and kvm_mmu_prefetch_sptes() installs writable
> SPTEs and drops the page references.  With kvm_handle_hva_range() ignoring
> gmem-only memslots, unmapping or reclaiming the VMA at slot->userspace_addr
> will not zap those prefetched SPTEs, giving the guest a host page
> use-after-free.

Well fudge.  That's a bug that needs to be fixed irrespective of this patch,
though it obviously needs to land first.

The TDP MMU doesn't support automatic prefetching, yet[*], and I'm planning on
using the "normal" fault flow for that support, so I think we can just disable
prefetching for gmem-only slots without negatively impacting any real-world
workload, and punt on proper support until someone cares, e.g.

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index f4b12d6aef55..a54196587235 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -3245,6 +3245,9 @@ static bool kvm_mmu_prefetch_sptes(struct kvm_vcpu *vcpu, gfn_t gfn, u64 *sptep,
 	if (!slot)
 		return false;
 
+	if (kvm_memslot_is_gmem_only(slot))
+		return false;
+
 	nr_pages = kvm_prefetch_pages(slot, gfn, pages, nr_pages);
 	if (nr_pages <= 0)
 		return false;

[*] https://lore.kernel.org/all/20261028202607.1844883-4-seanjc@google.com