From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.71 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792806943; b=h8NFC0D14ih2t/Skac0p3pRVc/8DA7yux6HTiOsvcfTZNHndWbezkOZRQ/iyFMyuh5bB h1RZ8g1ZXmlnsNMbTPqWHjWHge1r+IiRO6HpQzcBf0KuVeaJPQFmLqJ/UffCnVDgJLQTV tIBsAeS3mgNcvhepJr+113mPh2wi7AdpUJ0NNgA3MmJ7I+T+1CRpLbDDX6Xg7TqCJYm8C xofYCVWGTwnOhbbWQZ4WtK76fODwDAgwcpXyFHWBXxgl3S7phTEp5NlrDDYYa8tq5vAUs Zmlqxs4mSQwSZYxm9i0ev0Pf3BlYuqfB6iNn9cQdzG0DHQSjRzzpciiVtA25wRnpHRA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792806943; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:Mime-Version: X-Mailer:Message-ID:Subject:From:To:Cc:Content-Type; bh=NgwkcAh7G7TyRAJ1hK5wESY+6h2tjx7+XcYt+feArG0=; b=gqhhJRRBfsC7tNDDMU6NPVEp1xFXWy8POS09FFv3PVO/RBgMitgA3AX0yxiNuhcbTfak xU6GiJFTkqyJgauDYgdpkaXrt4lSGNC+5li5Q4DpgtOde+QFknzUYa6wyu9hklhWUEyNd GW6sAmS95MAWDUAyyeFJmOyPZGNKDcf27NnxtN2kY4c0Dgdw075VDOOtxbcB/w05wDAFU P8YUB+9ejA1goHOzBJS3yszuDqhhX+oHRFhavcnTkqD2PXxjrjheCrne2GpEsEp1NOjs/ 9XYGxFpKoeuvM++3DMiIrzIPAemcpLsq+DkqNd4LYg0R9+ol4Mxc3Q2Wcpqsh+zYxaw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=Nlbsh4UO; arc=none smtp.remote-ip=74.125.82.71 Received: from mail-dl1-f71.google.com (mail-dl1-f71.google.com [74.125.82.71]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 941FF606A31A for ; Sat, 24 Oct 2026 01:55:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 941FF606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=Nlbsh4UO Received: by mail-dl1-f71.google.com with SMTP id a92af1059eb24-1383723dfddso2581293c88.0 for ; Fri, 23 Oct 2026 18:55:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1792806942; x=1793411742; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NgwkcAh7G7TyRAJ1hK5wESY+6h2tjx7+XcYt+feArG0=; b=Nlbsh4UOoFahNOoAuPj9v5HGS1pWjjXyDelKFUfWeIl/2wsq76INs9hLZSw1vRPHLP PHUdbHiAcP2EYgQl4gowcoeh7tvDjvjksgmM+ACgDSdPeLJRQMeW3G91mctym84XiPkp JzJ5un+AD4vb/0YTZJiG5tVFwR+9NDlSIjvFrlTVIgvG+OJ5SZm2pYyeJ5oxZZyhp/vT LALC5IojEVkKlPHfITvWrT2nHkhC7Gr1KxKdfDlE2TYa0aehuG8PZbdyXOcD14zoPhIj JZ2hhzqAyZKvtNSmrxziWKv3L3VM0mNhlyCsk7dPIEfBTmjF3wrUMk+RpuAyICwQkqmf Lnpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792806942; x=1793411742; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=NgwkcAh7G7TyRAJ1hK5wESY+6h2tjx7+XcYt+feArG0=; b=QWwxGCv3cvZCQKp6TCkBsSYal6DYxvF71EgRZOTDFB9BzkEEJZqBoCvJQjX/8uFyOC BKGmwm/g1FV5W5FupppFostfRMvVbd1wPz2ZtT1UwTs2fopnnu2zkVFczmErORvmTblp o+Lu5FGLS42U9NcKUFQlPUHmsm4jluHV27KaDA3i2Hu7lG+ROC2UnPU+5Yv5fgUrfqNl 23ABFvMPHuMNzoo8xg0XmTgtagVgR+TC2o1ogKLkaV5uR0pBwtjPFAZvZLS8a3wJlFvY BET6WWO1YnOIZ1vDiDOETdpH8e3/rnMmPfhi2HbETT7K7xlxB8AXOMI3Wi0TwbABUXRm g09w== X-Forwarded-Encrypted: i=1; AKwUvBzqGEOgWUl+gaCEqqjBMoZ03Ci4ysZb+VhmUUbPSgS/S34Z+K6DUWEUjjdIPKrib+SzTABjX53hBbDUTCM=@vger.kernel.org X-Gm-Message-State: AFq9FYJLi7mVkqKYgdtzVMBtmDN5yPNm/ZLmnbI5pQfDeW32tEgo1HGQ w+10180I1sL618T86ImZ+YHBPbHL1BOyn50wUbPHFQFYQoYuKWVYpK7nMRWVQnX5rue1R2F+dgT i2B4bXqH+WtjlktGVZ0yEhfphrg== X-Received: from dybta14.prod.google.com ([2002:a05:7301:6f0e:b0:368:2c6d:de10]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:e990:b0:197:b597:c441 with SMTP id a92af1059eb24-1993f3f1820mr1399557c88.47.1792806941376; Fri, 23 Oct 2026 18:55:41 -0700 (PDT) Date: Sat, 24 Oct 2026 01:55:40 +0000 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 X-Mailer: git-send-email 2.56.0.257.gf7497c7d27-goog Message-ID: <20261024015540.538758-1-almasrymina@google.com> Subject: [PATCH v1] vfio/pci: pass FAULT_FLAG_WRITE to vmf_insert_pfn_pmd/pud() From: Mina Almasry To: Alex Williamson , Andrew Morton , Peter Xu , kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Mina Almasry , Kevin Tian , Jason Gunthorpe , stable@vger.kernel.org, Ankit Agrawal , "Ritesh Harjani (IBM)" Content-Type: text/plain; charset="UTF-8" vfio_pci_vmf_insert_pfn() unconditionally passes write=false to vmf_insert_pfn_pmd() and vmf_insert_pfn_pud(). In insert_pmd() and insert_pud(), write=false skips marking newly inserted PMD/PUD entries dirty/young via pmd_mkyoung(pmd_mkdirty()) and maybe_pmd_mkwrite(). Furthermore, when vma_wants_writenotify() is active on a shared writable VMA (for example, after CLEAR_REFS_SOFT_DIRTY clears VM_SOFTDIRTY and calls vma_set_page_prot()), vm_page_prot is downgraded to read-only so insert_pmd()/insert_pud() with write=false installs a write-protected huge PMD/PUD. Subsequent write faults enter wp_huge_pmd() or wp_huge_pud(), which invoke vma->vm_ops->huge_fault() to upgrade the entry in place. Because vfio_pci_vmf_insert_pfn() passes write=false, insert_pmd() and insert_pud() see !pmd_none(*pmd) with !write, do nothing, and return VM_FAULT_NOPAGE without setting the write bit or splitting the huge page, causing an infinite write page-fault loop. Pass vmf->flags & FAULT_FLAG_WRITE to vmf_insert_pfn_pmd() and vmf_insert_pfn_pud() so write faults properly mark huge PFNMAP entries dirty and writable. Fixes: f9e54c3a2f5b ("vfio/pci: implement huge_fault support") Cc: stable@vger.kernel.org Cc: Ankit Agrawal Cc: Ritesh Harjani (IBM) Assisted-by: LLM Signed-off-by: Mina Almasry --- drivers/vfio/pci/vfio_pci_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c index fcbb2da860e2..204d959086e9 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1745,6 +1745,8 @@ vm_fault_t vfio_pci_vmf_insert_pfn(struct vfio_pci_core_device *vdev, unsigned long pfn, unsigned int order) { + bool write = vmf->flags & FAULT_FLAG_WRITE; + lockdep_assert_held_read(&vdev->memory_lock); if (vdev->pm_runtime_engaged || !__vfio_pci_memory_enabled(vdev)) @@ -1754,10 +1756,10 @@ vm_fault_t vfio_pci_vmf_insert_pfn(struct vfio_pci_core_device *vdev, return vmf_insert_pfn(vmf->vma, vmf->address, pfn); if (IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_PFNMAP) && order == PMD_ORDER) - return vmf_insert_pfn_pmd(vmf, pfn, false); + return vmf_insert_pfn_pmd(vmf, pfn, write); if (IS_ENABLED(CONFIG_ARCH_SUPPORTS_PUD_PFNMAP) && order == PUD_ORDER) - return vmf_insert_pfn_pud(vmf, pfn, false); + return vmf_insert_pfn_pud(vmf, pfn, write); return VM_FAULT_FALLBACK; } base-commit: 076d7e989cb69f6ded7d60f2a080eb909930061b -- 2.56.0.257.gf7497c7d27-goog