Re: [PATCH 1/3] irqchip/gic-v3-its: Zero ITS pages before sharing them with the host

[Suzuki K Poulose]

Hi Fuad

On 06/11/2026 12:02, Fuad Tabba wrote:
> In a pKVM protected guest, the ITS driver shares every page it
> allocates for the GIC with the host, through set_memory_decrypted() in
> its_alloc_pages_node(). its_allocate_prop_table() is the only caller
> that doesn't pass __GFP_ZERO. It fills the table after the call
> returns, so until then the host can read the page's previous contents,
> at least 64KiB of guest memory.
>
> Zero every page in its_alloc_pages_node() before it is shared. Every
> caller except the property table already passes __GFP_ZERO.
>
> Fixes: b08e2f42e86b5 ("irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>

The patch, as such looks good to me and fixes the problem on pKVM.

We hit a similar problem with CCA, but not from a security perspective,
but a functionality perspective (crashing the Realm VM). There was a
patch proposed here [0]. The general consensus was to fix this for
all "shared allocations" and Aneesh has (had different attempts at this, 
but the latest) series is here [1]. Do you think something like this
would be preferred than fixing every caller like this ?

[0] https://lore.kernel.org/all/20260820150034.88729-2-steven.price@xxxxxxx
[1] 
https://lore.kernel.org/all/20261104164555.3555725-1-aneesh.kumar@xxxxxxxxxx

Cheers
SUzuki

> ---
>   drivers/irqchip/irq-gic-v3-its.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 282e4bafb084f..de1f1b1f26623 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -218,7 +218,8 @@ static struct page *its_alloc_pages_node(int node, gfp_t gfp,
>   	struct page *page;
>   	int ret = 0;
>   
> -	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
> +	/* Zeroed, as set_memory_decrypted() may share the page with the host */
> +	page = alloc_pages_node(node, gfp | gfp_flags_quirk | __GFP_ZERO, order);
>   
>   	if (!page)
>   		return NULL;