Re: [PATCH] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] pv_eoi_test_and_clr_pending() fails to clear KVM_APIC_PV_EOI_PENDING on guest memory access errors, leading to an infinite loop of spurious EOIs.
--

commit 8d31266dfac4b51fef59bed9e9475da6bffdd83d
Author: Sean Christopherson <seanjc@google.com>

KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

This commit fixes a host panic by explicitly ignoring internal requests
to service pending PV EOIs if the vCPU has disabled PV EOIs since the
request was made.

> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
[ ... ]
> @@ -3382,8 +3388,6 @@ static void apic_sync_pv_eoi_from_guest(struct kvm_vcpu *vcpu,
>  	 * KVM_APIC_PV_EOI_PENDING is set, KVM_PV_EOI_ENABLED is unset:
>  	 * 	-> host enabled PV EOI, guest executed EOI.
>  	 */
> -	BUG_ON(!pv_eoi_enabled(vcpu));
> -
>  	if (pv_eoi_test_and_clr_pending(vcpu))
>  		return;
>  	vector = apic_set_eoi(apic);

[Severity: High]
This is a pre-existing issue, but if pv_eoi_test_and_clr_pending() encounters
a memory access error, does it skip clearing the pending bit?

Looking at pv_eoi_test_and_clr_pending():

arch/x86/kvm/lapic.c:pv_eoi_test_and_clr_pending() {
    if (pv_eoi_get_user(vcpu, &val) < 0)
        return false;
    ...
    __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
    ...
}

If a guest provides an invalid memory address, pv_eoi_test_and_clr_pending()
returns false early without clearing KVM_APIC_PV_EOI_PENDING.

Will this cause apic_sync_pv_eoi_from_guest() to falsely assume the guest
performed an EOI and proceed to call apic_set_eoi() below?

Since the pending bit remains set, will KVM continue calling apic_set_eoi()
on every subsequent VM exit, erroneously clearing valid in-service interrupts
and making the VM completely unresponsive?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624220516.3033391-1-seanjc@google.com?part=1