mshv_vtl: Check per-CPU register page before mmap

[PATCH] mshv_vtl: Check per-CPU register page before mmap

Posted by Hardik Garg 1 week, 6 days ago

Register-page setup is optional for each CPU. If allocation or
registration fails, mshv_vtl_configure_reg_page() warns and leaves that
CPU's reg_page NULL, but initial context setup continues successfully.
Meanwhile, successful setup on another CPU sets the global
mshv_has_reg_page flag.

mshv_vtl_fault() checks this global flag before selecting the requested
CPU's register page. With mixed setup results across online CPUs, the
check passes even for a CPU with no register page, reaching
get_page(NULL) when userspace faults in that mapping.

Check the selected per-CPU register page before taking its reference and
return VM_FAULT_SIGBUS if it is absent.

Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
---
 drivers/hv/mshv_vtl_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
index fc993560a45c..3296ab5c0243 100644
--- a/drivers/hv/mshv_vtl_main.c
+++ b/drivers/hv/mshv_vtl_main.c
@@ -912,6 +912,9 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
 		return VM_FAULT_NOPAGE;
 	}
 
+	if (!page)
+		return VM_FAULT_SIGBUS;
+
 	get_page(page);
 	vmf->page = page;
 
-- 
2.34.1

Re: [PATCH] mshv_vtl: Check per-CPU register page before mmap

Posted by Naman Jain 1 week, 3 days ago


On 9/11/2026 11:21 PM, Hardik Garg wrote:
> Register-page setup is optional for each CPU. If allocation or
> registration fails, mshv_vtl_configure_reg_page() warns and leaves that
> CPU's reg_page NULL, but initial context setup continues successfully.
> Meanwhile, successful setup on another CPU sets the global
> mshv_has_reg_page flag.
> 
> mshv_vtl_fault() checks this global flag before selecting the requested
> CPU's register page. With mixed setup results across online CPUs, the
> check passes even for a CPU with no register page, reaching
> get_page(NULL) when userspace faults in that mapping.
> 
> Check the selected per-CPU register page before taking its reference and
> return VM_FAULT_SIGBUS if it is absent.
> 
> Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
> ---
>   drivers/hv/mshv_vtl_main.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
> index fc993560a45c..3296ab5c0243 100644
> --- a/drivers/hv/mshv_vtl_main.c
> +++ b/drivers/hv/mshv_vtl_main.c
> @@ -912,6 +912,9 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
>   		return VM_FAULT_NOPAGE;
>   	}
>   
> +	if (!page)
> +		return VM_FAULT_SIGBUS;
> +
>   	get_page(page);
>   	vmf->page = page;
>   


LGTM. Thanks.

Reviewed-by: Naman Jain <namjain@linux.microsoft.com>

Regards,
Naman

Re: [PATCH] mshv_vtl: Check per-CPU register page before mmap

Posted by Wei Liu 5 days, 14 hours ago

On Tue, Sep 15, 2026 at 10:11:36AM +0530, Naman Jain wrote:
> 
> 
> On 9/11/2026 11:21 PM, Hardik Garg wrote:
> > Register-page setup is optional for each CPU. If allocation or
> > registration fails, mshv_vtl_configure_reg_page() warns and leaves that
> > CPU's reg_page NULL, but initial context setup continues successfully.
> > Meanwhile, successful setup on another CPU sets the global
> > mshv_has_reg_page flag.
> > 
> > mshv_vtl_fault() checks this global flag before selecting the requested
> > CPU's register page. With mixed setup results across online CPUs, the
> > check passes even for a CPU with no register page, reaching
> > get_page(NULL) when userspace faults in that mapping.
> > 
> > Check the selected per-CPU register page before taking its reference and
> > return VM_FAULT_SIGBUS if it is absent.
> > 
> > Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
> > ---
> >   drivers/hv/mshv_vtl_main.c | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/drivers/hv/mshv_vtl_main.c b/drivers/hv/mshv_vtl_main.c
> > index fc993560a45c..3296ab5c0243 100644
> > --- a/drivers/hv/mshv_vtl_main.c
> > +++ b/drivers/hv/mshv_vtl_main.c
> > @@ -912,6 +912,9 @@ static vm_fault_t mshv_vtl_fault(struct vm_fault *vmf)
> >   		return VM_FAULT_NOPAGE;
> >   	}
> > +	if (!page)
> > +		return VM_FAULT_SIGBUS;
> > +
> >   	get_page(page);
> >   	vmf->page = page;
> 
> 
> LGTM. Thanks.
> 
> Reviewed-by: Naman Jain <namjain@linux.microsoft.com>

Applied. Thanks.