Re: [PATCH v1 2/2] KVM: arm64: Fix vma_shift staleness on nested hwpoison path

[Marc Zyngier <maz@kernel.org>]

On Thu, 05 Mar 2026 16:13:43 +0000,
Fuad Tabba <tabba@google.com> wrote:
> 
> On Thu, 5 Mar 2026 at 16:08, Marc Zyngier <maz@kernel.org> wrote:
> >
> > Hi Fuad,
> >
> > On Wed, 04 Mar 2026 16:22:22 +0000,
> > Fuad Tabba <tabba@google.com> wrote:
> > >
> > > When user_mem_abort() handles a nested stage-2 fault, it truncates
> > > vma_pagesize to respect the guest's mapping size. However, the local
> > > variable vma_shift is never updated to match this new size.
> > >
> > > If the underlying host page turns out to be hardware poisoned,
> > > kvm_send_hwpoison_signal() is called with the original, larger
> > > vma_shift instead of the actual mapping size. This signals incorrect
> > > poison boundaries to userspace and breaks hugepage memory poison
> > > containment for nested VMs.
> > >
> > > Update vma_shift to match the truncated vma_pagesize when operating
> > > on behalf of a nested hypervisor.
> > >
> > > Fixes: fd276e71d1e7 ("KVM: arm64: nv: Handle shadow stage 2 page faults")
> > > Signed-off-by: Fuad Tabba <tabba@google.com>
> > > ---
> > >  arch/arm64/kvm/mmu.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > >
> > > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > > index e1d6a4f591a9..b08240e0cab1 100644
> > > --- a/arch/arm64/kvm/mmu.c
> > > +++ b/arch/arm64/kvm/mmu.c
> > > @@ -1751,6 +1751,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> > >
> > >               force_pte = (max_map_size == PAGE_SIZE);
> > >               vma_pagesize = min_t(long, vma_pagesize, max_map_size);
> > > +             vma_shift = force_pte ? PAGE_SHIFT : __ffs(vma_pagesize);
> >
> > If force_pte is set, then we know that max_map_size == PAGE_SIZE. From
> > there, vma_pagesize == PAGE_SIZE, since nothing can be smaller.
> >
> > Is there anything preventing us from having:
> >
> >                 vma_shift = __ffs(vma_pagesize);
> >
> > and be done with it?
> 
> Nope, nothing prevents that. Even simpler and better.
> 
> Would you like me to respin it?

Nah, I'll fix that locally. Thanks for having given it a look.

	M.

-- 
Without deviation from the norm, progress is not possible.