Re: [PATCH] KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

[Jann Horn]

On Mon, Aug 10, 2026 at 6:29 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
> On Mon, Aug 10, 2026, Jann Horn wrote:
> > set_page_dirty() requires that the caller holds some kind of lock to
> > ensure that the page's mapping does not concurrently go away.
> > That is not the case for a random page we got from get_user_pages_fast(),
> > so use set_page_dirty_lock().
>
> FWIW, I verified that __kvm_gmem_populate() unlocks the destination folio before
> post_populate(), so we shouldn't run into deadlock when in-place conversion comes
> along and userspace does something odd.
>
> > Fixes: 97cd21d57e9b ("KVM: SEV: Mark source page dirty when writing back CPUID data on failure")
> > Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> > ---
> > Note that I have only convinced myself that this is a UAF bug by reading
> > the source code, and I have only compile-tested this patch; I do not
> > have SEV-SNP hardware to actually test this.
> >
> > This bug was introduced in v7.2-rc1, so if we can get the fix in before
> > the 7.2 release, this won't require a stable backport.
>
> Ya, that would be lovely.  Paolo?

Ping?
I still don't see this in mainline or in next.