Re: [PATCH v3] KVM: Skip gfn-based MMU notifier invalidations for guest_memfd-only memslots

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential
issues to consider:
- [High] KVM: x86/mmu: missing Signed-off-by trailer in commit message
- [Medium] KVM: x86/mmu: commit title and message do not match change in
  kvm_mmu_prefetch_sptes()
- [Low] KVM: x86/mmu: missing Fixes trailer for commit f029f04ddbec
--

commit 0029f5853016e6378c3fb60ef0b654f4ef090476
Author: Sean Christopherson <seanjc@google.com>

> KVM: Skip gfn-based MMU notifier invalidations for guest_memfd-only memslots
>
> On Fri, Nov 13, 2026, sashiko-bot@kernel.org wrote:
> > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > > index cf4cb586f1407..599dea22afb81 100644
> > > --- a/virt/kvm/kvm_main.c
> > > +++ b/virt/kvm/kvm_main.c
> > > @@ -601,6 +601,10 @@ static __always_inline kvm_mn_ret_t kvm_handle_hva_range(struct kvm *kvm,
> > >                     unsigned long hva_start, hva_end;
> > >
> > >                     slot = container_of(node, struct kvm_memory_slot, hva_node[slots->node_idx]);
> > > +
> > > +                   if (kvm_slot_has_gmem(slot) && kvm_memslot_is_gmem_only(slot))
> > > +                           continue;
> >
> > [Severity: Critical]
> > Can skipping guest_memfd-only memslots here leave writable SPTEs installed by
> > x86's kvm_mmu_prefetch_sptes() unzapped when the VMA at slot->userspace_addr
> > is unmapped?
> >
> > While __kvm_mmu_faultin_pfn() resolves the primary fault from guest_memfd for
> > gmem-only memslots, the post-fault PTE prefetch paths (such as FNAME(fetch)()
> > -> FNAME(pte_prefetch)() for nested EPT/NPT or shadow paging) call
> > kvm_mmu_prefetch_sptes() for neighboring GFNs without checking
> > kvm_memslot_is_gmem_only():
> >
> > arch/x86/kvm/mmu/mmu.c:kvm_mmu_prefetch_sptes() {
> >       slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, access & ACC_WRITE_MASK);
> >       if (!slot)
> >               return false;
> >
> >       nr_pages = kvm_prefetch_pages(slot, gfn, pages, nr_pages);
> >       if (nr_pages <= 0)
> >               return false;
> >
> >       for (i = 0; i < nr_pages; i++, gfn++, sptep++) {
> >               mmu_set_spte(vcpu, slot, sptep, access, gfn,
> >                            page_to_pfn(pages[i]), NULL);
> >               ...
> >               kvm_release_page_dirty(pages[i]);
> >       }
> > }
> >
> > kvm_prefetch_pages() resolves PFNs from slot->userspace_addr via
> > get_user_pages_fast_only(), and kvm_mmu_prefetch_sptes() installs writable
> > SPTEs and drops the page references.  With kvm_handle_hva_range() ignoring
> > gmem-only memslots, unmapping or reclaiming the VMA at slot->userspace_addr
> > will not zap those prefetched SPTEs, giving the guest a host page
> > use-after-free.
>
> Well fudge.  That's a bug that needs to be fixed irrespective of this patch,
> though it obviously needs to land first.
>
> The TDP MMU doesn't support automatic prefetching, yet[*], and I'm planning on
> using the "normal" fault flow for that support, so I think we can just disable
> prefetching for gmem-only slots without negatively impacting any real-world
> workload, and punt on proper support until someone cares, e.g.

[Severity: High]
The commit message is missing a Signed-off-by trailer.

[Severity: Medium]
The commit subject and message are an unedited email reply to a different
patch and end mid-sentence, rather than describing the change in
kvm_mmu_prefetch_sptes() to skip SPTE prefetching for guest_memfd-only
memslots.

[Severity: Low]
Since commit f029f04ddbec ("KVM: x86/mmu: Handle guest page faults for
guest_memfd with shared memory") updated __kvm_mmu_faultin_pfn() to fault
in pages from guest_memfd for gmem-only memslots while leaving
kvm_mmu_prefetch_sptes() resolving PFNs from slot->userspace_addr, should
this include:

  Fixes: f029f04ddbec ("KVM: x86/mmu: Handle guest page faults for guest_memfd with shared memory")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/avdGNbOO4562tk10@google.com?part=1