Re: [PATCH v9 12/16] KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Host kernel panic via NULL pointer dereference in PMU event creation when a guest without a PMU toggles `MDCR_EL2.HPME`.
--

--- Patch [12]: [PATCH v9 12/16] KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event() ---
commit 61c39cb093b2170b92839ae7097044db9d1474cc
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event()

This patch updates kvm_map_pmu_event() to accept the PMU structure directly
rather than implicitly looking it up via the VM argument. This prepares the
code to map events against a per-vCPU selected pPMU in the future.

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> index c5c505b6fc61c..27db8877f96ea 100644
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c
[ ... ]
> @@ -725,7 +723,7 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
>  	 * Don't create an event if we're running on hardware that requires
>  	 * PMUv3 event translation and we couldn't find a valid mapping.
>  	 */
> -	eventsel = kvm_map_pmu_event(vcpu->kvm, eventsel);
> +	eventsel = kvm_map_pmu_event(vcpu->kvm->arch.arm_pmu, eventsel);

[Severity: Critical]
This is a pre-existing issue, but this change makes it a bit more explicit.
Could this pass a NULL pointer to kvm_map_pmu_event() and cause a host kernel
panic?

If a guest with nested virtualization enabled but no PMU configured toggles
the MDCR_EL2.HPME bit, access_mdcr() will unconditionally trigger a
KVM_REQ_RELOAD_PMU request without checking if the VM actually has a PMU.

When kvm_vcpu_reload_pmu() handles this request on the next vCPU entry,
it tries to reprogram the cycle counter (which defaults to enabled). This
eventually reaches kvm_pmu_create_perf_event():

arch/arm64/kvm/sys_regs.c:access_mdcr() {
    ...
    kvm_pmu_handle_mdcr(vcpu, old, val); /* Triggers KVM_REQ_RELOAD_PMU */
}

arch/arm64/kvm/pmu-emul.c:kvm_pmu_create_perf_event() {
    ...
    eventsel = kvm_map_pmu_event(vcpu->kvm->arch.arm_pmu, eventsel);
}

arch/arm64/kvm/pmu-emul.c:kvm_map_pmu_event() {
    ...
    if (unlikely(pmu->map_pmuv3_event)) /* NULL pointer dereference */
}

Because no PMU was initialized for this guest, vcpu->kvm->arch.arm_pmu is NULL.

Could access_mdcr() or kvm_pmu_create_perf_event() check if the PMU is
actually initialized before attempting to create events?

>  	if (eventsel < 0)
>  		return;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-hybrid-v9-0-2b713ca1b5dc@rsg.ci.i.u-tokyo.ac.jp?part=12