Re: [PATCH v14 13/22] KVM: selftests: Support guest_memfd in-place conversion

[Michael Roth]

On Mon, Oct 12, 2026 at 01:09:15PM -0700, Sean Christopherson wrote:
> On Mon, Oct 12, 2026, Michael Roth wrote:
> > I don't have a reproducer for the specific ABBA in question though; I'm
> > confused at why sev_ioctl_do_platform_status() / SEV_CMD_PLATFORM_STATUS
> > would trigger a gmem fault (outside of malicious/intentional case) since
> > it is just querying status on behalf of host userspace and storing the
> > result in userspace buffer where there's no reason to use a guest/gmem
> > page. Was this test specifically set up to do this or was this reachable
> > from a normal path? Just trying to see if there are interactions I'm
> > failing to consider here.
> 
> I was just running KVM selftests, although I was running all of them at once.
> 
> The condition doesn't require an actual gmem fault.  The uaccess APIs have a
> __might_fault() to communicate that a page fault may occur, and lockdep is smart
> enough to piece together the problematic chain of locks.
> 
>   -> #1 (&mm->mmap_lock){++++}-{4:4}:
>          __might_fault+0x59/0x80  <===================
>          _copy_to_user+0x23/0x60
>          sev_ioctl_do_platform_status+0x50/0x80 [ccp]
>          sev_ioctl+0x220/0x2b0 [ccp]
>          __se_sys_ioctl+0x6d/0xb0
>          do_syscall_64+0xfe/0x460
>          entry_SYSCALL_64_after_hwframe+0x4b/0x53

Ok, that's pretty spiffy. I'll try that on my end as well.

Thanks!

-Mike