Re: [PATCH 26/31] KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: x86/mmu: lost memory attribute fault on GVA to GPA translation during emulation
--

commit a5b7ea3b514c528d86717bda8577133bab95a9d8
Author: Nicolas Saenz Julienne <nsaenz@amazon.com>

    KVM: x86/mmu: Issue memory fault exit if walk failed due to memory attribute

This commit modifies the guest page table walk to issue a user-space
memory fault exit if it fails due to memory attributes, instead of
injecting a page fault. It introduces the memory_attributes_fault
flag to the guest_walker structure.

> diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
> index b031123fcb369..cd055bfb1eb6b 100644
> --- a/arch/x86/kvm/mmu/paging_tmpl.h
> +++ b/arch/x86/kvm/mmu/paging_tmpl.h
[ ... ]
> @@ -820,6 +831,12 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
>  	 * The page is not mapped by the guest.  Let the guest handle it.
>  	 */
>  	if (!r) {
> +		if (walker.memory_attributes_fault) {
> +			kvm_prepare_memory_fault_exit(vcpu, walker.gfn << PAGE_SHIFT,
> +						      PAGE_SIZE, false, false, false);
> +			return -EFAULT;
> +		}
> +
>  		if (!fault->prefetch)
>  			__kvm_inject_emulated_page_fault(vcpu, &walker.fault, true);

[Severity: High]
Does FNAME(gva_to_gpa)() also need to handle the new memory_attributes_fault
flag?

FNAME(gva_to_gpa)() uses a local walker to translate guest virtual addresses
by calling FNAME(walk_addr_generic)():

static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, struct kvm_pagewalk *w,
			       gpa_t addr, u64 access,
			       struct x86_exception *exception)
{
	struct guest_walker walker;
	gpa_t gpa = INVALID_GPA;
	int r;

[ ... ]

	r = FNAME(walk_addr_generic)(&walker, vcpu, w, addr, access);

	if (r) {
		gpa = gfn_to_gpa(walker.gfn);
		gpa |= addr & ~PAGE_MASK;
	} else if (exception)
		*exception = walker.fault;

	return gpa;
}

If FNAME(walk_addr_generic)() detects a memory attribute fault when reading
guest page tables, it returns 0 with walker.memory_attributes_fault set.
However, FNAME(gva_to_gpa)() appears to ignore the new flag and only copies
walker.fault to the output exception.

Can this result in the instruction emulator improperly injecting a spurious
page fault into the guest instead of exiting to userspace with
KVM_EXIT_MEMORY_FAULT when guest page tables reside in memory restricted by
KVM memory attributes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918135030.171564-2-pbonzini@redhat.com?part=26