Re: [PATCH 5.15.y v3 4/7] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Guest-triggerable WARN_ON_ONCE in mmu_alloc_root causing host DoS.
--

commit 990a474db7a6b43a7cc3e9446db94141ba6c88d1
Author: Paolo Bonzini <pbonzini@redhat.com>

KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes

The quadrant is only used when gptes are 4 bytes, but
mmu_alloc_{direct,shadow}_roots() pass in a non-zero quadrant for PAE
page directories regardless. Make this less confusing by only passing in
a non-zero quadrant when it is actually necessary.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index b0504d40ac8c6..b7801690ea175 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -3474,9 +3474,10 @@ static hpa_t mmu_alloc_root(struct kvm_vcpu *vcpu, gfn_t gfn, int quadrant,
>  	struct kvm_mmu_page *sp;
>  
>  	role.level = level;
> +	role.quadrant = quadrant;
>  
> -	if (!role.gpte_is_8_bytes)
> -		role.quadrant = quadrant;
> +	WARN_ON_ONCE(quadrant && role.gpte_is_8_bytes);
> +	WARN_ON_ONCE(role.direct && !role.gpte_is_8_bytes);

[Severity: High]
Can this assertion be triggered by a guest on a host using a shadow MMU?

If a guest disables paging (CR0.PG=0) while the host is using a shadow MMU
(e.g., TDP is disabled), KVM computes the MMU role in
kvm_calc_shadow_mmu_root_page_role(), setting role.base.direct = 1 and
role.base.gpte_is_8_bytes = 0.

When KVM later allocates roots for this direct MMU via
mmu_alloc_direct_roots(), it calls mmu_alloc_root(), which causes this
WARN_ON_ONCE to evaluate to true and fire, resulting in a host DoS
that is reachable by any malicious or misconfigured guest.

This issue does not appear to be fixed in subsequent patches in this series.

>  
>  	sp = kvm_mmu_get_page(vcpu, gfn, role);
>  	++sp->root_count;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913155523.7423-1-k@mgml.me?part=4