Re: [PATCH v2 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch resolves an infinite VM-exit loop for `VMPTRLD` by injecting a `#UD` exception when eVMCS is active, but fails to apply the same fix to `handle_vmptrst`. In `handle_vmptrst`, returning 1 without skipping the instruction or queuing an exception resumes the guest at the exact same instruction, leading to a permanent infinite VM-exit loop (soft lockup) for the vCPU.
--

--- Patch [1]: [PATCH v2 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used ---
commit b2e2c0bdf82798edec492517d5390cf5a8348a25
Author: Vitaly Kuznetsov <vkuznets@redhat.com>

KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

VMPTRLD with active eVMCS is already forbidden, however, returning 1
without skipping the instruction or queuing an exception will likely
result in L1 getting stuck. Genuine Hyper-V seems to inject #UD under
similar circumstances, mimic the behavior in KVM.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 6957bb6f5cf7e..c78c67525ac9b 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -5883,6 +5883,12 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
>  	if (!nested_vmx_check_permission(vcpu))
>  		return 1;
>  
> +	/* Forbid normal VMPTRLD if Enlightened version was used */
> +	if (nested_vmx_is_evmptr12_valid(vmx)) {
> +		kvm_queue_exception(vcpu, UD_VECTOR);
> +		return 1;
> +	}
> +
>  	if (nested_vmx_get_vmptr(vcpu, &vmptr, &r))
>  		return r;
>  
> @@ -5892,10 +5898,6 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
>  	if (vmptr == vmx->nested.vmxon_ptr)
>  		return nested_vmx_fail(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
>  
> -	/* Forbid normal VMPTRLD if Enlightened version was used */
> -	if (nested_vmx_is_evmptr12_valid(vmx))
> -		return 1;
> -

[Severity: High]
This isn't a bug introduced by this patch, but does handle_vmptrst() suffer
from the same issue that this patch fixes in handle_vmptrld()?

Looking at handle_vmptrst():

arch/x86/kvm/vmx/nested.c:handle_vmptrst() {
...
	if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
		return 1;
...
}

Returning 1 here without skipping the instruction or queueing an exception
seems to resume the guest at the exact same VMPTRST instruction, potentially
leading to a permanent infinite VM-exit loop (soft lockup) for the vCPU.

Could handle_vmptrst() also be updated to inject a #UD exception?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818165258.2613603-1-vkuznets@redhat.com?part=1