Re: [PATCH 07/60] KVM: SVM: Add support for the SEV-SNP #HV IPI NAE event

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Unconditional dereference of `vcpu->arch.apic` before verifying its existence causes a host kernel panic if the in-kernel LAPIC is absent.
--

commit a2db726cf6351649d4f8b6df636d0b3bb754fe98
Author: Melody Wang <huibo.wang@amd.com>
KVM: SVM: Add support for the SEV-SNP #HV IPI NAE event

This commit introduces support for the #HV IPI NAE event for SEV-SNP
guests, allowing them to send IPIs to other vCPUs when Restricted
Injection is enabled. It implements the NAE event according to the GHCB
specification and adds a helper to send the IPI via x2APIC or xAPIC.

> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 4078e624ca667..ab40a2e4ab9d5 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c

[ ... ]

> @@ -3583,3 +3583,25 @@ void kvm_lapic_exit(void)
>  	static_key_deferred_flush(&apic_sw_disabled);
>  	WARN_ON(static_branch_unlikely(&apic_sw_disabled.key));
>  }
> +
> +/* Send IPI by writing ICR with MSR write when X2APIC enabled, with mmio write when XAPIC enabled */
> +int kvm_xapic_x2apic_send_ipi(struct kvm_vcpu *vcpu, u64 data)
> +{
> +	u32 icr_msr_addr = APIC_BASE_MSR + (APIC_ICR >> 4);
> +	struct kvm_lapic *apic = vcpu->arch.apic;
> +	gpa_t gpa = apic->base_address + APIC_ICR;

[Severity: Critical]
Does this unconditionally dereference the apic pointer before verifying it
is non-NULL?

If a guest or userspace process triggers the #HV IPI VMGEXIT for a VM
created without an in-kernel APIC, vcpu->arch.apic will be NULL. Because
apic->base_address is accessed immediately to calculate gpa, could this
trigger a host kernel panic?

Could the gpa calculation be deferred until after the kvm_lapic_enabled()
check to prevent this?

> +
> +	if (!kvm_lapic_enabled(vcpu))
> +		return 1;
> +
> +	if (vcpu->arch.apic_base & X2APIC_ENABLE) {
> +		if (!kvm_x2apic_msr_write(vcpu, icr_msr_addr, data))
> +			return 0;
> +	} else {
> +		if (!apic_mmio_write(vcpu, NULL, gpa, 4, &data))
> +			return 0;
> +	}
> +
> +	return 1;
> +}
> +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_xapic_x2apic_send_ipi);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608144252.351443-1-joro@8bytes.org?part=7