Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] An unprivileged userspace process can trigger a host kernel warning in sev_clflush_pfn(), violating KVM subsystem rules. --
--- Patch [3]: [RFC PATCH 03/11] KVM: SEV: Remove struct page dependency from SNP gmem paths --- commit 23550409886d9ce92ccb0c443cb1bc2d231b31b3 Author: Connor Williamson <[email protected]> KVM: SEV: Remove struct page dependency from SNP gmem paths This commit updates KVM SEV-SNP paths to support memory without a struct page by falling back to memremap() instead of relying on kmap_local_page(). It relaxes RMP helpers and updates cache flush paths to handle page-less PFNs. > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 4272293478766..2be9e3b80d85e 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c [ ... ] > @@ -5117,6 +5155,28 @@ int sev_gmem_prepare(struct kvm *kvm, kvm_pfn_t pfn, > gfn_t gfn, int max_order) > return 0; > } > > +/* > + * Flush the CPU caches for a guest_memfd PFN. A PFN from an external > + * guest_memfd provider may have no direct map alias, so fall back to a > + * temporary memremap() mapping for the cache flush. > + */ > +static void sev_clflush_pfn(kvm_pfn_t pfn, size_t size) > +{ > + void *va; > + > + if (pfn_valid(pfn)) { > + clflush_cache_range(__va(pfn_to_hpa(pfn)), size); > + return; > + } > + > + va = memremap(pfn_to_hpa(pfn), size, MEMREMAP_WB); > + if (WARN_ON_ONCE(!va)) [Severity: High] Is it safe to use WARN_ON_ONCE(!va) here when memremap() fails? Since userspace can trigger sev_clflush_pfn() during guest_memfd hole-punching (via sev_gmem_invalidate()), an unprivileged process might be able to trigger this warning by inducing memory pressure or vmalloc space exhaustion. This could result in a host denial of service if panic_on_warn is set. Should we drop the assertion here to prevent unprivileged userspace from intentionally triggering host warnings? > + return; > + > + clflush_cache_range(va, size); > + memunmap(va); > +} -- Sashiko AI review ยท https://sashiko.dev/#/patchset/f09647f427565c1789a6979470045aab78661563.1784194290.git.d...@amazon.co.uk?part=3
