Re: [PATCH] KVM: pfncache: Fix uhva validity check in kvm_gpc_is_valid_len()

[Phi Nguyen <phind.uet@gmail.com>]

On 3/9/2026 10:39 PM, Sean Christopherson wrote:
> On Mon, Mar 09, 2026, phind.uet@gmail.com wrote:
>> From: Nguyen Dinh Phi <phind.uet@gmail.com>
>>
>> In kvm_gpc_is_valid_len(), if the GPA is an error GPA, the function uses
>> uhva to calculate the page offset. However, if uhva is invalid, its value
>> can still be page-aligned (for example, PAGE_OFFSET) and this function will
>> still return true.
> 
> The HVA really shouldn't be invalid in the first place.  Ideally, Xen code wouldn't
> call kvm_gpc_refresh() on an inactive cache, but I suspect we'd end up with TOCTOU
> flaws even if we tried to add checks.
> 
> The next best thing would be to explicitly check if the gpc is active.  That should
> preserve the WARN if KVM tries to pass in a garbage address to __kvm_gpc_activate().
> 
> diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c
> index 728d2c1b488a..8372d1712471 100644
> --- a/virt/kvm/pfncache.c
> +++ b/virt/kvm/pfncache.c
> @@ -369,6 +369,9 @@ int kvm_gpc_refresh(struct gfn_to_pfn_cache *gpc, unsigned long len)
>   
>          guard(mutex)(&gpc->refresh_lock);
>   
> +       if (!gpc->active)
> +               return -EINVAL;
> +
>          if (!kvm_gpc_is_valid_len(gpc->gpa, gpc->uhva, len))
>                  return -EINVAL;
In this reproducer, userspace invokes KVM_XEN_HVM_EVTCHN_SEND without 
first configuring the cache. As a result, kvm_xen_set_evtchn_fast() 
returns -EWOULDBLOCK when kvm_gpc_check() fails. The -EWOULDBLOCK error 
then causes kvm_xen_set_evtchn() to fall back to calling kvm_gpc_refresh().

IMO, if the cache is not active, kvm_xen_set_evtchn_fast() should return 
-EINVAL instead. It may be better to check the active state of the GPC 
in kvm_xen_set_evtchn_fast() rather than kvm_gpc_refresh()?
Br,
Phi