* Re: [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording
2026-04-15 7:52 [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording Jiakai Xu
@ 2026-04-16 8:56 ` Andrew Jones
2026-04-17 6:40 ` Nutty.Liu
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Andrew Jones @ 2026-04-16 8:56 UTC (permalink / raw)
To: Jiakai Xu
Cc: kvm-riscv, kvm, linux-kernel, linux-riscv, Albert Ou,
Alexandre Ghiti, Andrew Jones, Anup Patel, Atish Patra,
Palmer Dabbelt, Paul Walmsley, Jiakai Xu
On Wed, Apr 15, 2026 at 07:52:16AM +0000, Jiakai Xu wrote:
> kvm_riscv_vcpu_record_steal_time() assumes that the steal-time shared
> memory GPA (vcpu->arch.sta.shmem) is always backed by a valid guest
> memory slot. However, this assumption is not guaranteed by the KVM
> userspace ABI.
>
> A malicious or buggy userspace can set the STA shared memory GPA via
> KVM_SET_ONE_REG without establishing a corresponding memory region via
> KVM_SET_USER_MEMORY_REGION. In such cases, the GPA cannot be translated
> to a valid HVA and kvm_vcpu_gfn_to_hva() returns an error address.
>
> The current implementation incorrectly treats this as a kernel warning
> using WARN_ON(), which may escalate to a kernel panic when panic_on_warn
> is enabled.
>
> This is not a kernel bug condition but a normal invalid configuration
> from userspace, and should be handled gracefully.
>
> Fix it by removing WARN_ON() and treating invalid HVA as a normal
> failure case, resetting the STA shared memory state.
>
> Fixes: e9f12b5fff8ad0 ("RISC-V: KVM: Implement SBI STA extension")
> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
> Assisted-by: OpenClaw:DeepSeek-V3.2
> ---
> arch/riscv/kvm/vcpu_sbi_sta.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_sbi_sta.c b/arch/riscv/kvm/vcpu_sbi_sta.c
> index 3b834709b429f..60e50296a0085 100644
> --- a/arch/riscv/kvm/vcpu_sbi_sta.c
> +++ b/arch/riscv/kvm/vcpu_sbi_sta.c
> @@ -46,7 +46,7 @@ void kvm_riscv_vcpu_record_steal_time(struct kvm_vcpu *vcpu)
> gfn = shmem >> PAGE_SHIFT;
> hva = kvm_vcpu_gfn_to_hva(vcpu, gfn);
>
> - if (WARN_ON(kvm_is_error_hva(hva))) {
> + if (kvm_is_error_hva(hva)) {
> vcpu->arch.sta.shmem = INVALID_GPA;
> return;
> }
> --
> 2.34.1
>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording
2026-04-15 7:52 [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording Jiakai Xu
2026-04-16 8:56 ` Andrew Jones
@ 2026-04-17 6:40 ` Nutty.Liu
2026-05-14 13:15 ` Anup Patel
2026-06-26 8:21 ` patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: Nutty.Liu @ 2026-04-17 6:40 UTC (permalink / raw)
To: Jiakai Xu, kvm-riscv, kvm, linux-kernel, linux-riscv
Cc: Albert Ou, Alexandre Ghiti, Andrew Jones, Anup Patel,
Atish Patra, Palmer Dabbelt, Paul Walmsley, Jiakai Xu
On 4/15/2026 3:52 PM, Jiakai Xu wrote:
> kvm_riscv_vcpu_record_steal_time() assumes that the steal-time shared
> memory GPA (vcpu->arch.sta.shmem) is always backed by a valid guest
> memory slot. However, this assumption is not guaranteed by the KVM
> userspace ABI.
>
> A malicious or buggy userspace can set the STA shared memory GPA via
> KVM_SET_ONE_REG without establishing a corresponding memory region via
> KVM_SET_USER_MEMORY_REGION. In such cases, the GPA cannot be translated
> to a valid HVA and kvm_vcpu_gfn_to_hva() returns an error address.
>
> The current implementation incorrectly treats this as a kernel warning
> using WARN_ON(), which may escalate to a kernel panic when panic_on_warn
> is enabled.
>
> This is not a kernel bug condition but a normal invalid configuration
> from userspace, and should be handled gracefully.
>
> Fix it by removing WARN_ON() and treating invalid HVA as a normal
> failure case, resetting the STA shared memory state.
>
> Fixes: e9f12b5fff8ad0 ("RISC-V: KVM: Implement SBI STA extension")
> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
> Assisted-by: OpenClaw:DeepSeek-V3.2
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Thanks,
Nutty
> ---
> arch/riscv/kvm/vcpu_sbi_sta.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_sbi_sta.c b/arch/riscv/kvm/vcpu_sbi_sta.c
> index 3b834709b429f..60e50296a0085 100644
> --- a/arch/riscv/kvm/vcpu_sbi_sta.c
> +++ b/arch/riscv/kvm/vcpu_sbi_sta.c
> @@ -46,7 +46,7 @@ void kvm_riscv_vcpu_record_steal_time(struct kvm_vcpu *vcpu)
> gfn = shmem >> PAGE_SHIFT;
> hva = kvm_vcpu_gfn_to_hva(vcpu, gfn);
>
> - if (WARN_ON(kvm_is_error_hva(hva))) {
> + if (kvm_is_error_hva(hva)) {
> vcpu->arch.sta.shmem = INVALID_GPA;
> return;
> }
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording
2026-04-15 7:52 [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording Jiakai Xu
2026-04-16 8:56 ` Andrew Jones
2026-04-17 6:40 ` Nutty.Liu
@ 2026-05-14 13:15 ` Anup Patel
2026-06-26 8:21 ` patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: Anup Patel @ 2026-05-14 13:15 UTC (permalink / raw)
To: Jiakai Xu
Cc: kvm-riscv, kvm, linux-kernel, linux-riscv, Albert Ou,
Alexandre Ghiti, Andrew Jones, Atish Patra, Palmer Dabbelt,
Paul Walmsley, Jiakai Xu
On Wed, Apr 15, 2026 at 1:22 PM Jiakai Xu <xujiakai2025@iscas.ac.cn> wrote:
>
> kvm_riscv_vcpu_record_steal_time() assumes that the steal-time shared
> memory GPA (vcpu->arch.sta.shmem) is always backed by a valid guest
> memory slot. However, this assumption is not guaranteed by the KVM
> userspace ABI.
>
> A malicious or buggy userspace can set the STA shared memory GPA via
> KVM_SET_ONE_REG without establishing a corresponding memory region via
> KVM_SET_USER_MEMORY_REGION. In such cases, the GPA cannot be translated
> to a valid HVA and kvm_vcpu_gfn_to_hva() returns an error address.
>
> The current implementation incorrectly treats this as a kernel warning
> using WARN_ON(), which may escalate to a kernel panic when panic_on_warn
> is enabled.
>
> This is not a kernel bug condition but a normal invalid configuration
> from userspace, and should be handled gracefully.
>
> Fix it by removing WARN_ON() and treating invalid HVA as a normal
> failure case, resetting the STA shared memory state.
>
> Fixes: e9f12b5fff8ad0 ("RISC-V: KVM: Implement SBI STA extension")
> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
> Assisted-by: OpenClaw:DeepSeek-V3.2
Queued this as fix for Linux-7.1-rcX
Thanks,
Anup
> ---
> arch/riscv/kvm/vcpu_sbi_sta.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kvm/vcpu_sbi_sta.c b/arch/riscv/kvm/vcpu_sbi_sta.c
> index 3b834709b429f..60e50296a0085 100644
> --- a/arch/riscv/kvm/vcpu_sbi_sta.c
> +++ b/arch/riscv/kvm/vcpu_sbi_sta.c
> @@ -46,7 +46,7 @@ void kvm_riscv_vcpu_record_steal_time(struct kvm_vcpu *vcpu)
> gfn = shmem >> PAGE_SHIFT;
> hva = kvm_vcpu_gfn_to_hva(vcpu, gfn);
>
> - if (WARN_ON(kvm_is_error_hva(hva))) {
> + if (kvm_is_error_hva(hva)) {
> vcpu->arch.sta.shmem = INVALID_GPA;
> return;
> }
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording
2026-04-15 7:52 [PATCH] RISC-V: KVM: Fix invalid HVA warning in steal-time recording Jiakai Xu
` (2 preceding siblings ...)
2026-05-14 13:15 ` Anup Patel
@ 2026-06-26 8:21 ` patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+linux-riscv @ 2026-06-26 8:21 UTC (permalink / raw)
To: Jiakai Xu
Cc: linux-riscv, kvm-riscv, kvm, linux-kernel, aou, alex, ajones,
anup, atish.patra, palmer, pjw, jiakaiPeanut
Hello:
This patch was applied to riscv/linux.git (fixes)
by Anup Patel <anup@brainfault.org>:
On Wed, 15 Apr 2026 07:52:16 +0000 you wrote:
> kvm_riscv_vcpu_record_steal_time() assumes that the steal-time shared
> memory GPA (vcpu->arch.sta.shmem) is always backed by a valid guest
> memory slot. However, this assumption is not guaranteed by the KVM
> userspace ABI.
>
> A malicious or buggy userspace can set the STA shared memory GPA via
> KVM_SET_ONE_REG without establishing a corresponding memory region via
> KVM_SET_USER_MEMORY_REGION. In such cases, the GPA cannot be translated
> to a valid HVA and kvm_vcpu_gfn_to_hva() returns an error address.
>
> [...]
Here is the summary with links:
- RISC-V: KVM: Fix invalid HVA warning in steal-time recording
https://git.kernel.org/riscv/c/653f17c74260
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread