Re: [PATCH] KVM: pfncache: invalidate sibling GPCs before releasing retry pages

[David Woodhouse]

On Thu, 2026-07-23 at 18:40 -0300, Heitor Alves de Siqueira wrote:
> If a concurrent munmap removes the page-table reference during that
> window, the GUP reference could be the last one left:
> kvm_release_page_unused() drops it and the page is freed while sibling
> GPCs could still hold mappings to the same physical page.

Thanks, but I think this is papering over the real problem, not fixing
it.

Those "sibling" GPCs that you mention just shouldn't exist, because
they're supposed to have been invalidated when the page was *unmapped*
— long before this temporary GUP reference gets dropped and the page is
actually *freed*.

That's the real bug, surely? And I think it's the same as
syzbot+0948c82180d475ad24e2¹ where a concurrent refresh misses the
invalidation?

A single-cache reproducer² triggers your exact splat with
no siblings involved. I'm working on a version of Sean's proposal³
(a dedicated invalidation sequence counter) which fixes both issues.

¹ https://lore.kernel.org/all/6a0c5f2c.a00a0220.2c7954.0000.GAE@xxxxxxxxxx/
² https://david.woodhou.se/vcpu_info_race.c
³ https://lore.kernel.org/all/aj2hi-NcqUUCaoQF@xxxxxxxxxx/

Attachment: smime.p7s
Description: S/MIME cryptographic signature