[PATCH] KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

[Jann Horn]

set_page_dirty() requires that the caller holds some kind of lock to
ensure that the page's mapping does not concurrently go away.
That is not the case for a random page we got from get_user_pages_fast(),
so use set_page_dirty_lock().

Fixes: 97cd21d57e9b ("KVM: SEV: Mark source page dirty when writing back CPUID data on failure")
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
---
Note that I have only convinced myself that this is a UAF bug by reading
the source code, and I have only compile-tested this patch; I do not
have SEV-SNP hardware to actually test this.

This bug was introduced in v7.2-rc1, so if we can get the fix in before
the 7.2 release, this won't require a stable backport.

For context, I have seen similar bugs (set_page_dirty() on a page from
GUP) in two out-of-tree drivers in the past, where this led to UAF.
Evidently set_page_dirty() is a bit of a footgun for GUP users...
---
 arch/x86/kvm/svm/sev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 0f0ea7896af5..49feef14787a 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -2389,7 +2389,7 @@ static int sev_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
 		void *dst_vaddr = kmap_local_pfn(pfn);
 
 		memcpy(src_vaddr, dst_vaddr, PAGE_SIZE);
-		set_page_dirty(src_page);
+		set_page_dirty_lock(src_page);
 
 		kunmap_local(dst_vaddr);
 		kunmap_local(src_vaddr);

---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260810-x86-kvm-setpagedirty-a04e49f066f0

Best regards,
--  
Jann Horn <jannh@xxxxxxxxxx>