Re: [PATCH RFC v2] KVM: pfncache: Check gpc->active before sanity checking GPA and HVA

On Wed, Jul 29, 2026 at 4:56 PM 'syzbot' via
syzkaller-upstream-moderation
<[email protected]> wrote:
>
> When attempting to refresh a gfn_to_pfn_cache (gpc) that has never been
> activated, KVM triggers a sanity-check warning in __kvm_gpc_refresh(). This
> occurs because an inactive cache naturally has both its GPA and HVA
> initialized to error values, which violates the condition that exactly one
> of them must be valid.
>
> This can be triggered via the KVM_XEN_HVM_EVTCHN_SEND ioctl. If the guest
> has not yet set up the shared info page, the shinfo_cache is inactive.
> Attempting to deliver the event returns -EWOULDBLOCK, prompting KVM to
> attempt a refresh of the cache, leading to the warning:
>
> ------------[ cut here ]------------
> kvm_is_error_gpa(gpa) == kvm_is_error_hva(uhva)
> WARNING: arch/x86/kvm/../../../virt/kvm/pfncache.c:267 at
> __kvm_gpc_refresh+0x1510/0x1710 virt/kvm/pfncache.c:267
> ...
> Call Trace:
>  <TASK>
>  kvm_gpc_refresh+0xe1/0x110 virt/kvm/pfncache.c:382
>  kvm_xen_set_evtchn+0x14f/0x220 arch/x86/kvm/xen.c:1945
>  kvm_xen_hvm_evtchn_send+0x120/0x1e0 arch/x86/kvm/xen.c:2036
>  kvm_arch_vm_ioctl+0xfad/0x1a10 arch/x86/kvm/x86.c:7523
>  kvm_vm_ioctl+0x8f7/0xd30 virt/kvm/kvm_main.c:5381
> ...
>
> The warning can also be triggered via vcpu_info_cache if an event is sent
> while the cache is inactive, causing the vCPU to attempt a refresh when
> injecting pending events.
>
> Fix this by moving the check for an inactive cache to kvm_gpc_refresh(),
> before calling __kvm_gpc_refresh(). It is completely safe to check
> gpc->active under gpc->refresh_lock because all modifications to
> gpc->active are fully serialized by gpc->refresh_lock. Bailing out early
> also avoids the overhead of unnecessarily acquiring and releasing the lock
> (which disables and re-enables interrupts) for a cache that cannot be
> refreshed.
>
> Fixes: 721f5b0dda78 ("KVM: pfncache: allow a cache to be activated with a fixed (userspace) HVA")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=cde12433b6c56f55d9ed
> Link: https://syzkaller.appspot.com/ai_job?id=06c5ed03-3710-4a03-8db9-c370eb80da49
> To: <[email protected]>
> To: "Paolo Bonzini" <[email protected]>
> To: "Paul Durrant" <[email protected]>
> Cc: <[email protected]>
Suggested-by: Sean Christopherson <[email protected]>