Re: [PATCH v14 13/22] KVM: selftests: Support guest_memfd in-place conversion

[Sean Christopherson <seanjc@google.com>]

On Mon, Oct 12, 2026, Michael Roth wrote:
> I don't have a reproducer for the specific ABBA in question though; I'm
> confused at why sev_ioctl_do_platform_status() / SEV_CMD_PLATFORM_STATUS
> would trigger a gmem fault (outside of malicious/intentional case) since
> it is just querying status on behalf of host userspace and storing the
> result in userspace buffer where there's no reason to use a guest/gmem
> page. Was this test specifically set up to do this or was this reachable
> from a normal path? Just trying to see if there are interactions I'm
> failing to consider here.

I was just running KVM selftests, although I was running all of them at once.

The condition doesn't require an actual gmem fault.  The uaccess APIs have a
__might_fault() to communicate that a page fault may occur, and lockdep is smart
enough to piece together the problematic chain of locks.

  -> #1 (&mm->mmap_lock){++++}-{4:4}:
         __might_fault+0x59/0x80  <===================
         _copy_to_user+0x23/0x60
         sev_ioctl_do_platform_status+0x50/0x80 [ccp]
         sev_ioctl+0x220/0x2b0 [ccp]
         __se_sys_ioctl+0x6d/0xb0
         do_syscall_64+0xfe/0x460
         entry_SYSCALL_64_after_hwframe+0x4b/0x53