Re: [PATCH v3 02/17] KVM: arm64: Add pkvm_remove_mappings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Bounds checking `WARN_ON(from > to)` is evaluated after pointer page-alignment, silently masking inverted address ranges and unmapping unintended memory.
--

--- Patch [2]: [PATCH v3 02/17] KVM: arm64: Add pkvm_remove_mappings ---
commit baa2f13b846b3ed54bd502767e4372648ba03b42
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Add pkvm_remove_mappings

This commit adds pkvm_remove_mappings() as a counterpart to
pkvm_create_mappings(). It allows previously mapped ranges to be removed,
which will be used by the upcoming pKVM heap allocator.

[ ... ]

> diff --git a/arch/arm64/kvm/hyp/nvhe/mm.c b/arch/arm64/kvm/hyp/nvhe/mm.c
> index 8b8c9d3dc82ad..5cd2f1fe51e4c 100644
> --- a/arch/arm64/kvm/hyp/nvhe/mm.c
> +++ b/arch/arm64/kvm/hyp/nvhe/mm.c
> @@ -157,6 +157,19 @@ int pkvm_create_mappings(void *from, void *to, enum kvm_pgtable_prot prot)
>  	return ret;
>  }
>  
> +void pkvm_remove_mappings(void *from, void *to)
> +{
> +	u64 size;
> +
> +	to = PTR_ALIGN(to, PAGE_SIZE);
> +	from = PTR_ALIGN_DOWN(from, PAGE_SIZE);
> +	size = (u64)to - (u64)from;
> +	WARN_ON(from > to);
[Severity: Medium]
Does checking from > to after page-alignment mask inverted bounds?

If a caller provides inverted address bounds that are close enough (e.g.,
from = 0x1050, to = 0x1040), the page-alignment operations will transform
them into a valid range (from = 0x1000, to = 0x2000).

The WARN_ON(from > to) check would then evaluate to false, bypassing the
warning and silently unmapping unintended hypervisor memory.

Could the WARN_ON(from > to) check be moved before the pointers are
modified by PTR_ALIGN and PTR_ALIGN_DOWN?

> +
> +	guard(hyp_spinlock)(&pkvm_pgd_lock);
> +	WARN_ON(kvm_pgtable_hyp_unmap(&pkvm_pgtable, (u64)from, size) != size);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720171513.1415357-1-vdonnefort@google.com?part=2