Re: [PATCH 18/24] KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] KVM reports misleading access flags (read/write/exec) to userspace in KVM_EXIT_MEMORY_FAULT when a software page table walk fails due to a memory attribute violation.
- [High] During instruction emulation, memory attribute faults on guest page table walks are ignored by FNAME(gva_to_gpa), causing KVM to incorrectly inject a spurious #PF into the guest instead of exiting to userspace.
--

--- Patch [18]: [PATCH 18/24] KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute ---
commit 724220bf46ef5e18dcf744c814e78fa2b6296962
Author: Nicolas Saenz Julienne <nsaenz@amazon.com>

KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute

This commit adds memory attribute checks to the guest page table walker. If
the walker encounters a page table entry residing in a memory region with
restricted attributes, it exits to userspace with a memory fault rather than
injecting a spurious page fault into the guest.

> diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
> index cdf05cd76d63d..23d7a7d9769fe 100644
> --- a/arch/x86/kvm/mmu/paging_tmpl.h
> +++ b/arch/x86/kvm/mmu/paging_tmpl.h

[ ... ]

> @@ -820,6 +828,12 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
>  	 * The page is not mapped by the guest.  Let the guest handle it.
>  	 */
>  	if (!r) {
> +		if (walker.memory_attributes_fault) {
> +			fault->gfn = walker.gfn;
> +			kvm_mmu_prepare_memory_fault_exit(vcpu, fault);

[Severity: High]
When setting up the memory fault exit here, do we end up reporting the
original instruction's access flags instead of the walker's?

The kvm_mmu_prepare_memory_fault_exit() function uses fault->write and
fault->exec. If an instruction fetch triggers the page fault, and KVM's
subsequent read of the guest page table fails the attribute check, userspace
might incorrectly be told the guest attempted to execute the page table
itself rather than just read it.

Could this cause the VMM to mismanage memory protections or spuriously
terminate the VM?

[Severity: High]
Does FNAME(gva_to_gpa) also need to check walker.memory_attributes_fault?

When FNAME(gva_to_gpa) translates guest virtual addresses during instruction
emulation, it calls into the walk functions but doesn't check the new
walker.memory_attributes_fault flag:

FNAME(gva_to_gpa)() {
        ...
        if (ndata) {
                ...
        } else if (exception)
                *exception = walker.fault;

        return gpa;
}

Will this cause KVM to incorrectly inject a spurious page fault into the guest
instead of exiting to userspace if an attribute violation occurs during
emulation?

> +			return -EFAULT;
> +		}
> +
>  		if (!fault->prefetch)
>  			__kvm_inject_emulated_page_fault(vcpu, &walker.fault, true);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716181456.402786-1-pbonzini@redhat.com?part=18