[PATCH] KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()

[PATCH] KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()

[Zenghui Yu]

From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>

Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2
descriptors looks really wrong, if offset is not zero. What we want to get
for swapping is hva + offset, not hva + offset*8. ;-)

Fix it.

Fixes: f6927b41d573 ("KVM: arm64: Add helper for swapping guest descriptor")
Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
---
 arch/arm64/kvm/at.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/at.c b/arch/arm64/kvm/at.c
index c5c5644b1878..a024d9a770dc 100644
--- a/arch/arm64/kvm/at.c
+++ b/arch/arm64/kvm/at.c
@@ -1753,7 +1753,7 @@ int __kvm_at_swap_desc(struct kvm *kvm, gpa_t ipa, u64 old, u64 new)
 	if (!writable)
 		return -EPERM;
 
-	ptep = (u64 __user *)hva + offset;
+	ptep = (void __user *)hva + offset;
 	if (cpus_have_final_cap(ARM64_HAS_LSE_ATOMICS))
 		r = __lse_swap_desc(ptep, old, new);
 	else
-- 
2.53.0

Re: [PATCH] KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()

[Marc Zyngier]

On Tue, 17 Mar 2026 11:57:48 +0000,
Zenghui Yu <zenghui.yu@linux.dev> wrote:
> 
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2
> descriptors looks really wrong, if offset is not zero. What we want to get
> for swapping is hva + offset, not hva + offset*8. ;-)
> 
> Fix it.
> 
> Fixes: f6927b41d573 ("KVM: arm64: Add helper for swapping guest descriptor")
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> ---
>  arch/arm64/kvm/at.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/at.c b/arch/arm64/kvm/at.c
> index c5c5644b1878..a024d9a770dc 100644
> --- a/arch/arm64/kvm/at.c
> +++ b/arch/arm64/kvm/at.c
> @@ -1753,7 +1753,7 @@ int __kvm_at_swap_desc(struct kvm *kvm, gpa_t ipa, u64 old, u64 new)
>  	if (!writable)
>  		return -EPERM;
>  
> -	ptep = (u64 __user *)hva + offset;
> +	ptep = (void __user *)hva + offset;
>  	if (cpus_have_final_cap(ARM64_HAS_LSE_ATOMICS))
>  		r = __lse_swap_desc(ptep, old, new);
>  	else

Holy crap! How did we miss that???

Thanks a lot for spotting it, I'll queue that now.

	M.

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH] KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()

[Marc Zyngier]

On Tue, 17 Mar 2026 19:57:48 +0800, Zenghui Yu wrote:
> Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2
> descriptors looks really wrong, if offset is not zero. What we want to get
> for swapping is hva + offset, not hva + offset*8. ;-)
> 
> Fix it.
> 
> 
> [...]

Applied to fixes, thanks!

[1/1] KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
      commit: 0496acc42fb51eee040b5170cec05cec41385540

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.