From nobody Tue Sep 29 08:26:16 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C48402DB791 for ; Mon, 10 Aug 2026 15:34:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376095; cv=none; b=OVp2zAP02morZ+Or6cl49oSaYIvq0gl57Q0aBz22/v2UpGaKL/Y41aLrSj9EkScYmXJzgMaTrVFcySGB0vA3zaWV66x7ZKvLA5kSoQasAtGTMRTB5L/8wH0/t/uJ0OPKaOptFJnNnDY8cd9NvQuIWV0cs3hqUcqqvS0IcSuDf9o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376095; c=relaxed/simple; bh=hKPX+mOjfHOBQZDisLrPxYD06+lONZjwhisWQ4vKDf4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=NLV5zM0BUOmVPgrd2fnhA+yx+kXZ0SLwmG7sa/BERmHLvIIu3EXxNWROd7qAn51WTh4Ir7dicHAPT1vmRtLZMl/lU0V9vwu7pw5hwJIgB4Puu1L3XbQFEdCTaSz48z0JWeGXi3qtqZwxG4czN8GHTYeAKl+/rO6tB694mFTM9EU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=upuiGS22; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="upuiGS22" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-498012a61f6so81875e9.0 for ; Mon, 10 Aug 2026 08:34:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786376092; x=1786980892; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=c33LbTJSjGuCzeDqGkQ4pNDET5O6ipd+Vg7r1pAYbeE=; b=upuiGS22D+34+VfWZn2ONubQ99sLIS1FpZhUQCGHbobcfBvCP9zrIMMfnB/bWG1IA0 hxh/tSc4DFq4oCoMjoXQ4SbGs874kybLhhtw5zZYjJYD0MfmSl6CW9Me2INrGB6AAd3b aHT/ITOzKRBssEqnVuRTNpwF5Tke1AVOqTupEeuc8eT+aVYJdUx/cYPI9go6eP3QCVTa j4ilkhDUKlVQNYUMw4m6Dz+PEAhVyuBxh55gD2wN7C39Fj4XWPd7gAuVf/v7aZpc1O3u E58SDuSJNcsr33Sef9+GW5/bgn38iLY2OzYX7QcO0mL8Jj4GsVFHCqbvJZPDE+hIbwkv Ssog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786376092; x=1786980892; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=c33LbTJSjGuCzeDqGkQ4pNDET5O6ipd+Vg7r1pAYbeE=; b=Mtl7f45w1riDbYYGFRYhXh96QPTTNxmij729zSH7sUBgjFHSsJeLnjabAe3CbYqOzf FRIZuOlfVZtIEBuEyBMOwVYR3G9yH0a5MEhSVKnpH4xmHYQvmLjKnluaiW+n/oeL3euB jwvY4/1E7fNeDjGtlXjuL9diDJQvOkmp4dqQBx90MHk5bcSRmMWirxrtxX+L46OsWiIE N+Z2aBSaloM3JCOMOT5Dqjp0mU+m8x7e0jty12R/I0TGDrEoemx2pEIsEJj41RH4X7U9 X3OQ2Fxcyt8JFC/fEaOpJ8A9rE+f9nVGTVUL/XmtJJCFgKvucvLoHBxgyO5AA2+9Ey0Y cRIQ== X-Forwarded-Encrypted: i=1; AHgh+RqsBIl1k6yZ8wlXt4QkYtWEE0WTkhruQ2vItnvwGIPoPNaATvJwowOiyV9yx2estYC/+XIZQ7+5KFkIDIY=@vger.kernel.org X-Gm-Message-State: AOJu0YwrAqiFT+sP9jxjeKDGALVdASlJOHLOjIFA4P3jaVdWN12xR48h pvPvPchPoUW9zHBccuxZjn+PTVo3peksrIG6CD8yg00j/C1RvihYo1orGQxWMYBxRg== X-Gm-Gg: AR+sD11UFboIK7/QiQdF7DGSGzwpZRi9D7GZOuvBMAVMdKYk9+ZHczTMDAuz/F032LR yvnCACYOpONkvi373NIlZphgu3f12vbQTghOZo81r761VhBbaN4qO+OIL8k3PMnG8B99OYlK9V1 21c/QmwUcZR/EVkwkLM10AyqXZdr3XtNJ2dTQoPwcUxiNof4NaDudxYLyy8AMhxV6LqzXj8Yi0K 2l60knez2Xe98Z1zW2aVD2p1XgkPS6mWcgMUN5O2f+KQeloO8aUAqrYFJTJ0GF+3kh0YqrgExT8 CbrBTHM7GtAcXbP9KJhj3QEDwGYvym5RogtPcPVCXfhmyAiosUVmWdbfQrTF8/FsyQ9ATnVa38H pSlKNeqIqu2A7eGi+tvzWwZR22L/Rad5gNHlsgRPoYngK416/ik43FEdg2oHMfnFIZ4cCmmvy3o sksss2Ys6eJrlaQUaUBYCL8bAxujorlMaRNPUCu4V7Xbxo1ON22kQ22YheJsEZatdaUtlunaRBC GloUinbXvAJTBzI/s84aJHQmX9nzWC0BNYZxdeCyTn2Xxw= X-Received: by 2002:a05:600c:6b18:b0:499:5f00:4cb5 with SMTP id 5b1f17b1804b1-49962474b50mr3053625e9.0.1786376091576; Mon, 10 Aug 2026 08:34:51 -0700 (PDT) Received: from localhost ([2a00:79e0:288a:8:5c4:b02b:cff6:9cc6]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-480021e7b3fsm38648521f8f.20.2026.08.10.08.34.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 08:34:50 -0700 (PDT) From: Jann Horn Date: Mon, 10 Aug 2026 17:33:59 +0200 Subject: [PATCH] KVM: SEV: Fix page dirtying in sev_gmem_post_populate() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260810-x86-kvm-setpagedirty-v1-1-85f180892d4f@google.com> X-B4-Tracking: v=1; b=H4sIAGbveWoC/yXMQQ6CMBBG4auQWTvJQEiDXsW4KPAXRyOSTiEQw t2tuvwW7+1kiAqjS7FTxKKm7zGjPBXU3f04gLXPpkoqJ00pvDaOn8uLDWnyA3qNaWMvNepzEOe CUE6niKDrb3u9/W1z+0CXvi86jg99tTZAeAAAAA== X-Change-ID: 20260810-x86-kvm-setpagedirty-a04e49f066f0 To: Sean Christopherson , Paolo Bonzini Cc: Ackerley Tng , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, "Matthew Wilcox (Oracle)" , Jan Kara , Jann Horn X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786376044; l=1657; i=jannh@google.com; s=20240730; h=from:subject:message-id; bh=hKPX+mOjfHOBQZDisLrPxYD06+lONZjwhisWQ4vKDf4=; b=DAc5cALWvZ0LC4ly82cuSkAgxL7iVz6jIR4TGMX0mdPah0bZec/7Vb50vrR8t9+B8mkkkel+c 0Cz8Cfdsz9ECiAaOXHws0PHZNXFSRrBRdpghVt+SJxDKLblMxdaXSsd X-Developer-Key: i=jannh@google.com; a=ed25519; pk=AljNtGOzXeF6khBXDJVVvwSEkVDGnnZZYqfWhP1V+C8= set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock(). Fixes: 97cd21d57e9b ("KVM: SEV: Mark source page dirty when writing back CP= UID data on failure") Signed-off-by: Jann Horn Reviewed-by: Sean Christopherson --- Note that I have only convinced myself that this is a UAF bug by reading the source code, and I have only compile-tested this patch; I do not have SEV-SNP hardware to actually test this. This bug was introduced in v7.2-rc1, so if we can get the fix in before the 7.2 release, this won't require a stable backport. For context, I have seen similar bugs (set_page_dirty() on a page from GUP) in two out-of-tree drivers in the past, where this led to UAF. Evidently set_page_dirty() is a bit of a footgun for GUP users... --- arch/x86/kvm/svm/sev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 0f0ea7896af5..49feef14787a 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2389,7 +2389,7 @@ static int sev_gmem_post_populate(struct kvm *kvm, gf= n_t gfn, kvm_pfn_t pfn, void *dst_vaddr =3D kmap_local_pfn(pfn); =20 memcpy(src_vaddr, dst_vaddr, PAGE_SIZE); - set_page_dirty(src_page); + set_page_dirty_lock(src_page); =20 kunmap_local(dst_vaddr); kunmap_local(src_vaddr); --- base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 change-id: 20260810-x86-kvm-setpagedirty-a04e49f066f0 Best regards, -- =20 Jann Horn