[ciqlts8_6] Multiple patches tested (2 commits)#1412
Open
ciq-kernel-automation[bot] wants to merge 2 commits into
Open
[ciqlts8_6] Multiple patches tested (2 commits)#1412ciq-kernel-automation[bot] wants to merge 2 commits into
ciq-kernel-automation[bot] wants to merge 2 commits into
Conversation
jira VULN-186742 cve CVE-2026-46113 commit-author Sean Christopherson <seanjc@google.com> commit 0cb2af2 upstream-diff | Upstream fixes this in kvm_mmu_get_child_sp() and __link_shadow_page(). Neither exists on this tree, so the fix goes into the open-coded interior-SPTE reuse in __direct_map() and FNAME(fetch). An existing interior SPTE is reused only when its child still maps the gfn about to be installed. Otherwise it's dropped and the correct child is installed. The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous). - the PDE mapping is changed from outside the guest. - the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped. - the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3. - any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED). The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but *actually* only happens in response to a guest write. That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93 ("KVM: MMU: Don't allocate gfns page for direct mmu pages") came along. Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy. Fixes: 2032a93 ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Fixes: 6aa8b73 ("kvm: userspace interface") Reported-by: Alexander Bulekov <bkov@amazon.com> Reported-by: Fred Griffoul <fgriffo@amazon.co.uk> Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 0cb2af2) Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
ciq-kernel-automation
Bot
added
the
created-by-kernelci
|
🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28876835474 |
🔍 Interdiff Analysis
================================================================================
* DELTA DIFFERENCES - code changes that differ between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -1169,6 +1169,29 @@
rmap_remove(kvm, sptep);
}
+
+static bool __drop_large_spte(struct kvm *kvm, u64 *sptep)
+{
+ if (is_large_pte(*sptep)) {
+ WARN_ON(sptep_to_sp(sptep)->role.level == PG_LEVEL_4K);
+ drop_spte(kvm, sptep);
+ --kvm->stat.lpages;
+ return true;
+ }
+
+ return false;
+}
+
+static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
+{
+ if (__drop_large_spte(vcpu->kvm, sptep)) {
+ struct kvm_mmu_page *sp = sptep_to_sp(sptep);
+
+ kvm_flush_remote_tlbs_with_address(vcpu->kvm, sp->gfn,
+ KVM_PAGES_PER_HPAGE(sp->role.level));
+ }
+}
+
/*
* Write-protect on the specified @sptep, @pt_protect indicates whether
* spte write-protection is caused by protecting shadow page table.
@@ -2289,33 +2312,6 @@
return 0;
}
-static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn)
-{
- struct kvm_mmu_page *child;
-
- if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep))
- return false;
-
- child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK);
- return child && child->gfn == gfn;
-}
-
-static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
-{
- struct kvm *kvm = vcpu->kvm;
- struct kvm_mmu_page *parent_sp;
- LIST_HEAD(invalid_list);
-
- if (!is_shadow_present_pte(*sptep))
- return;
-
- parent_sp = sptep_to_sp(sptep);
- WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K);
-
- mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list);
- kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true);
-}
-
static int kvm_mmu_page_unlink_children(struct kvm *kvm,
struct kvm_mmu_page *sp,
struct list_head *invalid_list)
@@ -3001,10 +2997,10 @@
if (it.level == level)
break;
- if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
+ drop_large_spte(vcpu, it.sptep);
+ if (is_shadow_present_pte(*it.sptep))
continue;
- drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
it.level - 1, true, ACC_ALL);
################################################################################
! REJECTED PATCH2 HUNKS - could not be compared; manual review needed !
################################################################################
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -182,6 +182,8 @@
struct kmem_cache *mmu_page_header_cache;
static void mmu_spte_set(u64 *sptep, u64 spte);
+static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
+ u64 *spte, struct list_head *invalid_list);
struct kvm_mmu_role_regs {
const unsigned long cr0;
@@ -1287,19 +1289,6 @@
rmap_remove(kvm, sptep);
}
-static void drop_large_spte(struct kvm *kvm, u64 *sptep, bool flush)
-{
- struct kvm_mmu_page *sp;
-
- sp = sptep_to_sp(sptep);
- WARN_ON_ONCE(sp->role.level == PG_LEVEL_4K);
-
- drop_spte(kvm, sptep);
-
- if (flush)
- kvm_flush_remote_tlbs_sptep(kvm, sptep);
-}
-
/*
* Write-protect on the specified @sptep, @pt_protect indicates whether
* spte write-protection is caused by protecting shadow page table.
@@ -2466,7 +2455,8 @@
{
union kvm_mmu_page_role role;
- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep))
+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
return ERR_PTR(-EEXIST);
role = kvm_mmu_child_role(sptep, direct, access);
@@ -2544,13 +2534,16 @@
BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
- /*
- * If an SPTE is present already, it must be a leaf and therefore
- * a large one. Drop it, and flush the TLB if needed, before
- * installing sp.
- */
- if (is_shadow_present_pte(*sptep))
- drop_large_spte(kvm, sptep, flush);
+ if (is_shadow_present_pte(*sptep)) {
+ struct kvm_mmu_page *parent_sp;
+ LIST_HEAD(invalid_list);
+
+ parent_sp = sptep_to_sp(sptep);
+ WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K);
+
+ mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list);
+ kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true);
+ }
spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp));
================================================================================
* CONTEXT DIFFERENCES - surrounding code differences between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2996,8 +2541,13 @@
- drop_large_spte(vcpu, it.sptep);
- if (is_shadow_present_pte(*it.sptep))
- continue;
+ BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
+
+ /*
+ * If an SPTE is present already, it must be a leaf and therefore
+ * a large one. Drop it, and flush the TLB if needed, before
+ * installing sp.
+ */
+ if (is_shadow_present_pte(*sptep))
+ drop_large_spte(kvm, sptep, flush);
- sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
- it.level - 1, true, ACC_ALL);
+ spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp));
================================================================================
* ONLY IN PATCH1 - files not modified by patch2 *
================================================================================
--- b/arch/x86/kvm/mmu/paging_tmpl.h
+++ a/arch/x86/kvm/mmu/paging_tmpl.h
@@ -659,11 +659,11 @@
gfn_t table_gfn;
clear_sp_write_flooding_count(it.sptep);
+ drop_large_spte(vcpu, it.sptep);
- table_gfn = gw->table_gfn[it.level - 2];
sp = NULL;
+ if (!is_shadow_present_pte(*it.sptep)) {
+ table_gfn = gw->table_gfn[it.level - 2];
- if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) {
- drop_large_spte(vcpu, it.sptep);
access = gw->pt_access[it.level - 2];
sp = kvm_mmu_get_page(vcpu, table_gfn, addr,
it.level-1, false, access);
@@ -721,8 +721,9 @@
validate_direct_spte(vcpu, it.sptep, direct_access);
+ drop_large_spte(vcpu, it.sptep);
+
+ if (!is_shadow_present_pte(*it.sptep)) {
- if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) {
- drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
it.level - 1, true, direct_access);
link_shadow_page(vcpu, it.sptep, sp);
================================================================================
* DELTA DIFFERENCES - code changes that differ between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2053,13 +2053,20 @@
__clear_sp_write_flooding_count(sptep_to_sp(spte));
}
-static union kvm_mmu_page_role
-kvm_mmu_child_role(struct kvm_vcpu *vcpu, gva_t gaddr, unsigned int level,
- int direct, unsigned int access)
+static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
+ gfn_t gfn,
+ gva_t gaddr,
+ unsigned level,
+ int direct,
+ unsigned int access)
{
bool direct_mmu = vcpu->arch.mmu->direct_map;
union kvm_mmu_page_role role;
+ struct hlist_head *sp_list;
unsigned quadrant;
+ struct kvm_mmu_page *sp;
+ int collisions = 0;
+ LIST_HEAD(invalid_list);
role = vcpu->arch.mmu->mmu_role.base;
role.level = level;
@@ -2073,25 +2080,6 @@
role.quadrant = quadrant;
}
- return role;
-}
-
-static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
- gfn_t gfn,
- gva_t gaddr,
- unsigned level,
- int direct,
- unsigned int access)
-{
- bool direct_mmu = vcpu->arch.mmu->direct_map;
- union kvm_mmu_page_role role;
- struct hlist_head *sp_list;
- struct kvm_mmu_page *sp;
- int collisions = 0;
- LIST_HEAD(invalid_list);
-
- role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access);
-
sp_list = &vcpu->kvm->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)];
for_each_valid_sp(vcpu->kvm, sp, sp_list) {
if (sp->gfn != gfn) {
@@ -2301,22 +2289,15 @@
return 0;
}
-static bool kvm_mmu_child_sp_exists(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
- gva_t gaddr, unsigned int level, int direct,
- unsigned int access)
+static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn)
{
- union kvm_mmu_page_role role;
struct kvm_mmu_page *child;
if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep))
return false;
child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK);
- if (!child)
- return false;
-
- role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access);
- return child->gfn == gfn && child->role.word == role.word;
+ return child && child->gfn == gfn;
}
static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
@@ -3020,8 +3001,7 @@
if (it.level == level)
break;
- if (kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, it.addr,
- it.level - 1, true, ACC_ALL))
+ if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
continue;
drop_large_spte(vcpu, it.sptep);
################################################################################
! REJECTED PATCH2 HUNKS - could not be compared; manual review needed !
################################################################################
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2459,7 +2459,7 @@
u64 *sptep, gfn_t gfn,
bool direct, unsigned int access)
{
- union kvm_mmu_page_role role;
+ union kvm_mmu_page_role role = kvm_mmu_child_role(sptep, direct, access);
if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
@@ -2461,8 +2461,11 @@
{
union kvm_mmu_page_role role;
- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
- spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
+ if (is_shadow_present_pte(*sptep) &&
+ !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) &&
+ spte_to_child_sp(*sptep)->gfn == gfn &&
+ spte_to_child_sp(*sptep)->role.word == role.word)
return ERR_PTR(-EEXIST);
role = kvm_mmu_child_role(sptep, direct, access);
@@ -2465,7 +2468,6 @@
spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
return ERR_PTR(-EEXIST);
- role = kvm_mmu_child_role(sptep, direct, access);
return kvm_mmu_get_shadow_page(vcpu, gfn, role);
}
================================================================================
* CONTEXT DIFFERENCES - surrounding code differences between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2743,6 +2456,13 @@
- if (it.level == level)
- break;
+ u64 *sptep, gfn_t gfn,
+ bool direct, unsigned int access)
+{
+ union kvm_mmu_page_role role;
- if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
- continue;
+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
+ return ERR_PTR(-EEXIST);
+
+ role = kvm_mmu_child_role(sptep, direct, access);
+ return kvm_mmu_get_shadow_page(vcpu, gfn, role);
+}
================================================================================
* ONLY IN PATCH1 - files not modified by patch2 *
================================================================================
--- b/arch/x86/kvm/mmu/paging_tmpl.h
+++ a/arch/x86/kvm/mmu/paging_tmpl.h
@@ -661,11 +661,10 @@
clear_sp_write_flooding_count(it.sptep);
table_gfn = gw->table_gfn[it.level - 2];
- access = gw->pt_access[it.level - 2];
sp = NULL;
+ if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) {
- if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, table_gfn, addr,
- it.level - 1, false, access)) {
drop_large_spte(vcpu, it.sptep);
+ access = gw->pt_access[it.level - 2];
sp = kvm_mmu_get_page(vcpu, table_gfn, addr,
it.level-1, false, access);
/*
@@ -722,8 +721,7 @@
validate_direct_spte(vcpu, it.sptep, direct_access);
+ if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) {
- if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, addr,
- it.level - 1, true, direct_access)) {
drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
it.level - 1, true, direct_access);This is an automated interdiff check for backported commits. |
|
✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28876835474 |
jira VULN-191426 cve CVE-2026-53359 commit-author Paolo Bonzini <pbonzini@redhat.com> commit 81ccda3 upstream-diff | Upstream adds the check to kvm_mmu_get_child_sp(), which doesn't exist here, so it goes into kvm_mmu_child_sp_exists() at the reuse sites in __direct_map() and FNAME(fetch). The expected role comes from kvm_mmu_child_role(), split out of kvm_mmu_get_page() (as upstream did in 2e65e84) so the check and the allocator can't derive different roles. Commit 0cb2af2 ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Fixes: 2032a93 ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Reported-by: Hyunwoo Kim <imv4bel@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 81ccda3) Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
kerneltoast
force-pushed
the
{sultan_januscape}_ciqlts8_6
branch
from
bc85aeb to
f7a421d
Compare
|
🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28903177706 |
🔍 Interdiff Analysis
================================================================================
* DELTA DIFFERENCES - code changes that differ between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -1169,6 +1169,29 @@
rmap_remove(kvm, sptep);
}
+
+static bool __drop_large_spte(struct kvm *kvm, u64 *sptep)
+{
+ if (is_large_pte(*sptep)) {
+ WARN_ON(sptep_to_sp(sptep)->role.level == PG_LEVEL_4K);
+ drop_spte(kvm, sptep);
+ --kvm->stat.lpages;
+ return true;
+ }
+
+ return false;
+}
+
+static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
+{
+ if (__drop_large_spte(vcpu->kvm, sptep)) {
+ struct kvm_mmu_page *sp = sptep_to_sp(sptep);
+
+ kvm_flush_remote_tlbs_with_address(vcpu->kvm, sp->gfn,
+ KVM_PAGES_PER_HPAGE(sp->role.level));
+ }
+}
+
/*
* Write-protect on the specified @sptep, @pt_protect indicates whether
* spte write-protection is caused by protecting shadow page table.
@@ -2289,33 +2312,6 @@
return 0;
}
-static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn)
-{
- struct kvm_mmu_page *child;
-
- if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep))
- return false;
-
- child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK);
- return child && child->gfn == gfn;
-}
-
-static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
-{
- struct kvm *kvm = vcpu->kvm;
- struct kvm_mmu_page *parent_sp;
- LIST_HEAD(invalid_list);
-
- if (!is_shadow_present_pte(*sptep))
- return;
-
- parent_sp = sptep_to_sp(sptep);
- WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K);
-
- mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list);
- kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true);
-}
-
static int kvm_mmu_page_unlink_children(struct kvm *kvm,
struct kvm_mmu_page *sp,
struct list_head *invalid_list)
@@ -3001,10 +2997,10 @@
if (it.level == level)
break;
- if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
+ drop_large_spte(vcpu, it.sptep);
+ if (is_shadow_present_pte(*it.sptep))
continue;
- drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
it.level - 1, true, ACC_ALL);
################################################################################
! REJECTED PATCH2 HUNKS - could not be compared; manual review needed !
################################################################################
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -182,6 +182,8 @@
struct kmem_cache *mmu_page_header_cache;
static void mmu_spte_set(u64 *sptep, u64 spte);
+static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
+ u64 *spte, struct list_head *invalid_list);
struct kvm_mmu_role_regs {
const unsigned long cr0;
@@ -1287,19 +1289,6 @@
rmap_remove(kvm, sptep);
}
-static void drop_large_spte(struct kvm *kvm, u64 *sptep, bool flush)
-{
- struct kvm_mmu_page *sp;
-
- sp = sptep_to_sp(sptep);
- WARN_ON_ONCE(sp->role.level == PG_LEVEL_4K);
-
- drop_spte(kvm, sptep);
-
- if (flush)
- kvm_flush_remote_tlbs_sptep(kvm, sptep);
-}
-
/*
* Write-protect on the specified @sptep, @pt_protect indicates whether
* spte write-protection is caused by protecting shadow page table.
@@ -2466,7 +2455,8 @@
{
union kvm_mmu_page_role role;
- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep))
+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
return ERR_PTR(-EEXIST);
role = kvm_mmu_child_role(sptep, direct, access);
@@ -2544,13 +2534,16 @@
BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
- /*
- * If an SPTE is present already, it must be a leaf and therefore
- * a large one. Drop it, and flush the TLB if needed, before
- * installing sp.
- */
- if (is_shadow_present_pte(*sptep))
- drop_large_spte(kvm, sptep, flush);
+ if (is_shadow_present_pte(*sptep)) {
+ struct kvm_mmu_page *parent_sp;
+ LIST_HEAD(invalid_list);
+
+ parent_sp = sptep_to_sp(sptep);
+ WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K);
+
+ mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list);
+ kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true);
+ }
spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp));
================================================================================
* CONTEXT DIFFERENCES - surrounding code differences between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2996,8 +2541,13 @@
- drop_large_spte(vcpu, it.sptep);
- if (is_shadow_present_pte(*it.sptep))
- continue;
+ BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
+
+ /*
+ * If an SPTE is present already, it must be a leaf and therefore
+ * a large one. Drop it, and flush the TLB if needed, before
+ * installing sp.
+ */
+ if (is_shadow_present_pte(*sptep))
+ drop_large_spte(kvm, sptep, flush);
- sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
- it.level - 1, true, ACC_ALL);
+ spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp));
================================================================================
* ONLY IN PATCH1 - files not modified by patch2 *
================================================================================
--- b/arch/x86/kvm/mmu/paging_tmpl.h
+++ a/arch/x86/kvm/mmu/paging_tmpl.h
@@ -659,11 +659,11 @@
gfn_t table_gfn;
clear_sp_write_flooding_count(it.sptep);
+ drop_large_spte(vcpu, it.sptep);
- table_gfn = gw->table_gfn[it.level - 2];
sp = NULL;
+ if (!is_shadow_present_pte(*it.sptep)) {
+ table_gfn = gw->table_gfn[it.level - 2];
- if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) {
- drop_large_spte(vcpu, it.sptep);
access = gw->pt_access[it.level - 2];
sp = kvm_mmu_get_page(vcpu, table_gfn, addr,
it.level-1, false, access);
@@ -721,8 +721,9 @@
validate_direct_spte(vcpu, it.sptep, direct_access);
+ drop_large_spte(vcpu, it.sptep);
+
+ if (!is_shadow_present_pte(*it.sptep)) {
- if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) {
- drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
it.level - 1, true, direct_access);
link_shadow_page(vcpu, it.sptep, sp);
================================================================================
* DELTA DIFFERENCES - code changes that differ between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2053,13 +2053,20 @@
__clear_sp_write_flooding_count(sptep_to_sp(spte));
}
-static union kvm_mmu_page_role
-kvm_mmu_child_role(struct kvm_vcpu *vcpu, gva_t gaddr, unsigned level,
- int direct, unsigned int access)
+static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
+ gfn_t gfn,
+ gva_t gaddr,
+ unsigned level,
+ int direct,
+ unsigned int access)
{
bool direct_mmu = vcpu->arch.mmu->direct_map;
union kvm_mmu_page_role role;
+ struct hlist_head *sp_list;
unsigned quadrant;
+ struct kvm_mmu_page *sp;
+ int collisions = 0;
+ LIST_HEAD(invalid_list);
role = vcpu->arch.mmu->mmu_role.base;
role.level = level;
@@ -2073,25 +2080,6 @@
role.quadrant = quadrant;
}
- return role;
-}
-
-static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
- gfn_t gfn,
- gva_t gaddr,
- unsigned level,
- int direct,
- unsigned int access)
-{
- bool direct_mmu = vcpu->arch.mmu->direct_map;
- union kvm_mmu_page_role role;
- struct hlist_head *sp_list;
- struct kvm_mmu_page *sp;
- int collisions = 0;
- LIST_HEAD(invalid_list);
-
- role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access);
-
sp_list = &vcpu->kvm->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)];
for_each_valid_sp(vcpu->kvm, sp, sp_list) {
if (sp->gfn != gfn) {
@@ -2301,22 +2289,15 @@
return 0;
}
-static bool kvm_mmu_child_sp_exists(struct kvm_vcpu *vcpu, u64 *sptep,
- gfn_t gfn, gva_t gaddr, unsigned level,
- int direct, unsigned int access)
+static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn)
{
- union kvm_mmu_page_role role;
struct kvm_mmu_page *child;
if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep))
return false;
child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK);
- if (!child)
- return false;
-
- role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access);
- return child->gfn == gfn && child->role.word == role.word;
+ return child && child->gfn == gfn;
}
static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
@@ -3020,8 +3001,7 @@
if (it.level == level)
break;
- if (kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, it.addr,
- it.level - 1, true, ACC_ALL))
+ if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
continue;
drop_large_spte(vcpu, it.sptep);
################################################################################
! REJECTED PATCH2 HUNKS - could not be compared; manual review needed !
################################################################################
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2459,7 +2459,7 @@
u64 *sptep, gfn_t gfn,
bool direct, unsigned int access)
{
- union kvm_mmu_page_role role;
+ union kvm_mmu_page_role role = kvm_mmu_child_role(sptep, direct, access);
if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
@@ -2461,8 +2461,11 @@
{
union kvm_mmu_page_role role;
- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
- spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
+ if (is_shadow_present_pte(*sptep) &&
+ !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) &&
+ spte_to_child_sp(*sptep)->gfn == gfn &&
+ spte_to_child_sp(*sptep)->role.word == role.word)
return ERR_PTR(-EEXIST);
role = kvm_mmu_child_role(sptep, direct, access);
@@ -2465,7 +2468,6 @@
spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
return ERR_PTR(-EEXIST);
- role = kvm_mmu_child_role(sptep, direct, access);
return kvm_mmu_get_shadow_page(vcpu, gfn, role);
}
================================================================================
* CONTEXT DIFFERENCES - surrounding code differences between the patches *
================================================================================
--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2743,6 +2456,13 @@
- if (it.level == level)
- break;
+ u64 *sptep, gfn_t gfn,
+ bool direct, unsigned int access)
+{
+ union kvm_mmu_page_role role;
- if (kvm_mmu_child_sp_exists(it.sptep, base_gfn))
- continue;
+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) &&
+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn)
+ return ERR_PTR(-EEXIST);
+
+ role = kvm_mmu_child_role(sptep, direct, access);
+ return kvm_mmu_get_shadow_page(vcpu, gfn, role);
+}
================================================================================
* ONLY IN PATCH1 - files not modified by patch2 *
================================================================================
--- b/arch/x86/kvm/mmu/paging_tmpl.h
+++ a/arch/x86/kvm/mmu/paging_tmpl.h
@@ -661,11 +661,10 @@
clear_sp_write_flooding_count(it.sptep);
table_gfn = gw->table_gfn[it.level - 2];
- access = gw->pt_access[it.level - 2];
sp = NULL;
+ if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) {
- if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, table_gfn, addr,
- it.level - 1, false, access)) {
drop_large_spte(vcpu, it.sptep);
+ access = gw->pt_access[it.level - 2];
sp = kvm_mmu_get_page(vcpu, table_gfn, addr,
it.level-1, false, access);
/*
@@ -722,9 +721,7 @@
validate_direct_spte(vcpu, it.sptep, direct_access);
+ if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) {
- if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, addr,
- it.level - 1, true,
- direct_access)) {
drop_large_spte(vcpu, it.sptep);
sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
it.level - 1, true, direct_access);This is an automated interdiff check for backported commits. |
|
✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28903177706 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR has been automatically created after successful completion of all CI stages.
Commit Message(s)
Reproducing and testing Januscape
Prerequisites
Steps (inside the guest)
makesudo rmmod kvm_intelsudo insmod poc.kosudo rmmod pocsudo insmod poc.koExpected result
The host panics with a KVM shadow-MMU rmap corruption, with a signature like:
Verifying the fix
Install the patched kernel on the host, boot into it, and repeat the same PoC runs from the guest. With the fix applied the host survives all runs (no pte_list_remove)
Test Results
✅ Build Stage
✅ Boot Verification
✅ Kernel Selftests
✅ LTP Results
🤖 This PR was automatically generated by GitHub Actions
Run ID: 28861381028