[PATCH] KVM: arm64: nv: Skip vCPUs without a pseudo-TLB in invalidate_vncr_va()

[Marc Zyngier]

On Sun, 07 Jun 2026 14:36:44 +0100,
Hyunwoo Kim <imv4bel at gmail.com> wrote:
> 
> On Sun, Jun 07, 2026 at 02:05:02PM +0100, Marc Zyngier wrote:
> > On Sun, 07 Jun 2026 09:43:53 +0100,
> > Hyunwoo Kim <imv4bel at gmail.com> wrote:
> > > 
> > > vncr_tlb is not allocated before a vCPU runs for the first time, so
> > > vcpu->arch.vncr_tlb is NULL for a vCPU that has been created but not yet
> > > run. Code that iterates over every vCPU's pseudo-TLB must skip those.
> > > 
> > > invalidate_vncr_va() iterates over the vCPUs with kvm_for_each_vcpu() and
> > > dereferences vt->valid without checking whether vncr_tlb is NULL.
> > > 
> > > While iterating, skip vCPUs whose pseudo-TLB has not been allocated.
> > >
> > > Fixes: 4ffa72ad8f37 ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2")
> > > Signed-off-by: Hyunwoo Kim <imv4bel at gmail.com>
> > > ---
> > >  arch/arm64/kvm/nested.c | 4 ++++
> > >  1 file changed, 4 insertions(+)
> > > 
> > > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > > index 6f7bc9a9992e..063e079d1d1a 100644
> > > --- a/arch/arm64/kvm/nested.c
> > > +++ b/arch/arm64/kvm/nested.c
> > > @@ -969,6 +969,10 @@ static void invalidate_vncr_va(struct kvm *kvm,
> > >  		struct vncr_tlb *vt = vcpu->arch.vncr_tlb;
> > >  		u64 va_start, va_end, va_size;
> > >  
> > > +		/* Skip vCPUs whose pseudo-TLB hasn't been allocated yet */
> > > +		if (!vt)
> > > +			continue;
> > > +
> > >  		if (!vt->valid)
> > >  			continue;
> > >  
> > 
> > This looks correct and matches what we already have for
> > invalidate_vncr_ipa().
> > 
> > But I think this misses the opportunity to squash a whole class of
> > similar bugs, should we ever have the need for another function that
> > iterates over all *valid* VNCR pseudo-TLBs.
> > 
> > Since I'm on a train and have nothing better to do, I've written the
> > following hack.
> > 
> > Thoughts?
> 
> Looks like a good direction to me. I confirmed it fixes the issue (as
> expected).
> 
> How about you submit this patch yourself?

Sure, can do. I'll sent that in a minute.

> > +#define kvm_for_each_vncr_tlb(idx, vcpup, tlbp, kvm)	\
> > +	kvm_for_each_vcpu(idx, vcpu, kvm)		\
> 
> Maybe vcpu -> vcpup?

Duh. Yes. Thanks.

	M.

-- 
Jazz isn't dead. It just smells funny.