From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Paolo Bonzini <pbonzini@redhat.com>,
David Matlack <dmatlack@google.com>, Kenta Akagi <k@mgml.me>
Subject: Re: [PATCH 5.15.y v3 4/7] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
Date: Mon, 14 Sep 2026 22:03:23 -0400 [thread overview]
Message-ID: <daily-reply-0007-re-kvm-mmu-quadrant-warn-5-15@kernel.org> (raw)
In-Reply-To: <20260913155523.7423-5-k@mgml.me>
> + WARN_ON_ONCE(quadrant && role.gpte_is_8_bytes);
> + WARN_ON_ONCE(role.direct && !role.gpte_is_8_bytes);
The second WARN is guest triggerable on 5.15 on any host running with ept=0 or
npt=0. For a non-paging guest kvm_calc_shadow_mmu_root_page_role() yields
direct=1 while kvm_calc_shadow_root_page_role_common() leaves gpte_is_8_bytes
at 0, so mmu_alloc_root() hits it on an ordinary guest entry. Under
panic_on_warn that is a host DoS.
It has the same root as the 3/7 comment: 5.15 spells the field gpte_is_8_bytes
rather than has_4_byte_gpte, so the upstream logic inverts when it is carried
over as-is. Keeping "if (role.direct) role.gpte_is_8_bytes = true;" in
mmu_alloc_root() and kvm_mmu_child_role() covers both, or backport the upstream
role-computation change first.
Patches 1, 2, 5, 6 and 7 look good. Could you respin as v4 with those two
addressed?
--
Thanks,
Sasha
next prev parent reply other threads:[~2026-09-15 2:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-13 15:55 [PATCH 5.15.y v3 0/7] KVM: fixes for CVE-2026-46113 and related issues Kenta Akagi
2026-09-13 15:55 ` [PATCH 5.15.y v3 1/7] KVM: x86/mmu: Use a bool for direct Kenta Akagi
2026-09-13 15:55 ` [PATCH 5.15.y v3 2/7] KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() Kenta Akagi
2026-09-13 15:55 ` [PATCH 5.15.y v3 3/7] KVM: x86/mmu: Derive shadow MMU page role from parent Kenta Akagi
2026-09-15 2:03 ` Sasha Levin
2026-09-13 15:55 ` [PATCH 5.15.y v3 4/7] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes Kenta Akagi
2026-09-15 2:03 ` Sasha Levin [this message]
2026-09-13 15:55 ` [PATCH 5.15.y v3 5/7] KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() Kenta Akagi
2026-09-13 15:55 ` [PATCH 5.15.y v3 6/7] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Kenta Akagi
2026-09-13 15:55 ` [PATCH 5.15.y v3 7/7] KVM: x86: Fix shadow paging use-after-free due to unexpected role Kenta Akagi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=daily-reply-0007-re-kvm-mmu-quadrant-warn-5-15@kernel.org \
--to=sashal@kernel.org \
--cc=dmatlack@google.com \
--cc=k@mgml.me \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®