Re: [PATCH] KVM: riscv: Set Accessed bit in dirty-log write fault fast path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: riscv: host memory corruption via dirty logging fast path
--

commit b1648eda48b2a005ceca6ca39f80fd20aed60966
Author: SeungJu Cheon <suunj1331@gmail.com>
KVM: riscv: Set Accessed bit in dirty-log write fault fast path

This patch fixes an issue where the fast path for dirty logging write
faults loops indefinitely on hardware that faults when the Accessed bit
is clear. It ensures the accessed bit is set alongside write and dirty
bits.

Cc: stable@vger.kernel.org # 7.2+

> diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
> index 371fccaf9df08..21637b7959730 100644
> --- a/arch/riscv/kvm/mmu.c
> +++ b/arch/riscv/kvm/mmu.c
[ ... ]
> @@ -591,14 +591,15 @@ static bool kvm_riscv_mmu_dirty_log_write_fault_fast(struct kvm *kvm,
[ ... ]
> -		new_pte = pte_mkdirty(pte_mkwrite_novma(old_pte));
> +		new_pte = pte_mkyoung(pte_mkdirty(pte_mkwrite_novma(old_pte)));

[Severity: Critical]
Does this unconditionally set the _PAGE_WRITE bit on the stage-2 PTE
without verifying if the original mapping was host-writable?

When dirty logging is enabled, a guest write to a previously read-only
mapped page can trigger kvm_riscv_mmu_map() with logging enabled:

kvm_riscv_mmu_map()
    if (is_write && logging &&
        kvm_riscv_mmu_dirty_log_write_fault_fast(kvm, memslot, gpa, out_map))
        return 0;

If we unconditionally add _PAGE_WRITE here via pte_mkwrite_novma(),
could an unprivileged guest bypass host write-protection by reading an
unallocated page (like the shared zero page) and then writing to it
during live migration?

This appears to bypass the host writability checks in the slow path's
__kvm_faultin_pfn(), which might allow a guest to write directly into
host read-only pages, such as CoW mappings or the shared zero page.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016101458.221648-1-suunj1331@gmail.com?part=1