Re: [PATCH 3/3] KVM: arm64: nv: Move to per nested mmu ptdump files

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel panic on error path due to kvm_free_stage2_pgd() being called on uninitialized kvm_s2_mmu elements.
--

commit b126bbf9b1139c4e5f8f15f1b55bdfca981c84c3
Author: Wei-Lin Chang <weilin.chang@arm.com>

KVM: arm64: nv: Move to per nested mmu ptdump files

Move the creation of shadow page table debugfs files to be per-nested-mmu
instance instead of recreating them on context binding, avoiding sleeping
operations while holding the mmu_lock.

Link: https://lore.kernel.org/kvmarm/aiuF0KSvvv-ZozI1@sm-arm-grace07/

> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> index fb54f6dad995c..07f94b8b82365 100644
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c

[ ... ]

> @@ -125,6 +130,9 @@ int kvm_vcpu_init_nested(struct kvm_vcpu *vcpu)
>  		return ret;
>  	}
>  

[Severity: High]
This is a pre-existing issue, but does the error path cleanup loop just
above this return in kvm_vcpu_init_nested() cause a kernel panic if
init_nested_s2_mmu() fails?

The cleanup loop unconditionally calls kvm_free_stage2_pgd() on array
elements from kvm->arch.nested_mmus_size to num_mmus - 1:

	if (ret) {
		for (int i = kvm->arch.nested_mmus_size; i < num_mmus; i++)
			kvm_free_stage2_pgd(&kvm->arch.nested_mmus[i]);

For any element that failed initialization or wasn't visited yet, the
kvm_s2_mmu element remains zero-initialized, meaning mmu->arch is NULL.
Inside arch/arm64/kvm/mmu.c:kvm_free_stage2_pgd(), it calls
kvm_s2_mmu_to_kvm(mmu) which derives the kvm pointer via container_of()
on mmu->arch. This yields an invalid pointer, and the subsequent
write_lock(&kvm->mmu_lock) dereferences it, crashing the kernel.

> +	for (int i = kvm->arch.nested_mmus_size; i < num_mmus; i++)
> +		kvm_nested_s2_ptdump_create_debugfs(&kvm->arch.nested_mmus[i]);
> +
>  	kvm->arch.nested_mmus_size = num_mmus;
>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623142443.648972-1-weilin.chang@arm.com?part=3