Re: [PATCH 6/6] KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added `WARN_ON_ONCE(map->hva)` in `__kvm_vcpu_map()` can be intentionally triggered by a malicious L1 guest during a failed nested VM-entry, leading to a host panic if `panic_on_warn` is set. This violates KVM subsystem guidelines against guest-reachable asserts.
--

--- Patch [6]: [PATCH 6/6] KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references ---
commit 8ccf1780ac5defdd7cc6ad600af4fce97f3731bd
Author: Sean Christopherson <seanjc@google.com>

KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references

This commit explicitly unmaps existing mappings in __kvm_vcpu_map() when
map->hva is already set. This change hardens the code against memory leaks 
from zero-allocated maps. It also adds a WARN_ON_ONCE() to alert on double 
mappings.

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 2df8ee9ecf6c6..e9e32686e41be 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -3118,6 +3118,9 @@ int __kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
>  		.pin = true,
>  	};
>  
> +	if (WARN_ON_ONCE(map->hva))
> +		kvm_vcpu_unmap(vcpu, map);
> +

[Severity: High]
Can this WARN_ON_ONCE() be triggered by a malicious L1 guest, potentially
causing a host panic if panic_on_warn is set?

If an L1 guest sets up a VMCS12 that requires mapped pages (e.g. for APIC
accesses) but provides an invalid guest state, KVM maps the pages in
nested_vmx_enter_non_root_mode() via nested_get_vmcs12_pages(). If the state
check fails:

arch/x86/kvm/vmx/nested.c:nested_vmx_enter_non_root_mode() {
    ...
		if (nested_vmx_check_guest_state(vcpu, vmcs12,
						 &entry_failure_code)) {
			exit_reason.basic = EXIT_REASON_INVALID_STATE;
			vmcs12->exit_qualification = entry_failure_code;
			goto vmentry_fail_vmexit;
		}
    ...
}

KVM jumps to vmentry_fail_vmexit and returns to the L1 guest, but skips
calling nested_put_vmcs12_pages(). This leaves the pages mapped. When the L1
guest executes VMLAUNCH again, KVM attempts to map the pages again, map->hva
is already populated, and this WARN_ON_ONCE() is unconditionally triggered.

Does this violate the KVM subsystem guidelines against guest-reachable
assertions?

>  	map->pinned_page = NULL;
>  	map->page = NULL;
>  	map->hva = NULL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724004757.131420-1-seanjc@google.com?part=6