From: Sean Christopherson <seanjc@google.com>
To: Ethan Yang <ethan.yang.kernel@gmail.com>
Cc: kvm@vger.kernel.org, xiaoyao.li@intel.com, pbonzini@redhat.com,
syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
x86@kernel.org, tglx@kernel.org, mingo@redhat.com, bp@alien8.de,
dave.hansen@linux.intel.com, hpa@zytor.com, glider@google.com
Subject: Re: [PATCH v2] KVM: x86: Don't leave APF half-enabled on bad APF data GPA
Date: Mon, 6 Apr 2026 09:18:47 -0700 [thread overview]
Message-ID: <adPc51OyKMdkU4pc@google.com> (raw)
In-Reply-To: <20260403100119.3311-1-ethan.yang.kernel@gmail.com>
Thanks for posting this! My "week" estimate was wee bit off...
On Fri, Apr 03, 2026, Ethan Yang wrote:
> static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu)
> @@ -3616,6 +3621,7 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
> {
> gpa_t gpa = data & ~0x3f;
> + bool enable;
>
> /* Bits 4:5 are reserved, Should be zero */
> if (data & 0x30)
> @@ -3632,18 +3638,20 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
> if (!lapic_in_kernel(vcpu))
> return data ? 1 : 0;
>
> + enable = __kvm_pv_async_pf_enabled(data);
> +
> + if (enable &&
> + kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> + sizeof(u64)))
I would rather forgo a local variable and either hhave the below check stay as
kvm_pv_async_pf_enabled() or just redo the call to __kvm_pv_async_pf_enabled().
> + return 1;
Newline please.
> vcpu->arch.apf.msr_en_val = data;
>
> - if (!kvm_pv_async_pf_enabled(vcpu)) {
> + if (!enable) {
> kvm_clear_async_pf_completion_queue(vcpu);
> kvm_async_pf_hash_reset(vcpu);
> return 0;
> }
>
> - if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
> - sizeof(u64)))
> - return 1;
> -
> vcpu->arch.apf.send_always = (data & KVM_ASYNC_PF_SEND_ALWAYS);
> vcpu->arch.apf.delivery_as_pf_vmexit = data & KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT;
As I sketched out, in a follow-up patch, I would like to to update these fields
as well. I don't like tracking stale information, even if it _should_ be unused.
Actually, even better, just drop the fields. That way zeroing msr_en_val via
INIT won't lead to stale data either.
I'll post a v3, should be easier overall than posting diffs for the suggestions
and then making you write changelogs :-)
prev parent reply other threads:[~2026-04-06 16:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-16 5:05 [syzbot] [kvm?] WARNING in kvm_read_guest_offset_cached syzbot
2025-07-16 15:23 ` Sean Christopherson
2026-02-10 9:21 ` Alexander Potapenko
2026-02-26 1:47 ` Sean Christopherson
2026-04-03 3:11 ` [PATCH] KVM: x86: Don't leave APF half-enabled on bad APF data GPA Ethan Yang
2026-04-03 8:11 ` Xiaoyao Li
2026-04-03 10:01 ` [PATCH v2] " Ethan Yang
2026-04-06 16:18 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=adPc51OyKMdkU4pc@google.com \
--to=seanjc@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=ethan.yang.kernel@gmail.com \
--cc=glider@google.com \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=syzbot+bc0e18379a290e5edfe4@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox