Re: [PATCH v6 13/18] KVM: arm64: Alloc pkvm_hyp_vm using pKVM heap allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64: memcg accounting bypass in pKVM hyp allocator top-ups
--

commit c6ba9fe98ea9532d6a486e0ae326359e821cd9d4
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Alloc pkvm_hyp_vm using pKVM heap allocator

Transition the allocation of the hypervisor VM state structure (pkvm_hyp_vm)
from the host to the hypervisor using the new pKVM heap allocator. The host
now uses pkvm_call_hyp_req() to invoke __pkvm_init_vm, automatically handling
any top-up requests if the hypervisor runs out of heap memory.

> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index ea96744f41fb0..8505965dbfb21 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -230,28 +230,15 @@ static int __pkvm_create_hyp_vm(struct kvm *kvm)
>  	if (!pgd)
>  		return -ENOMEM;
>  
> -	/* Allocate memory to donate to hyp for vm and vcpu pointers. */
> -	hyp_vm_sz = PAGE_ALIGN(size_add(PKVM_HYP_VM_SIZE,
> -					size_mul(sizeof(void *),
> -						 kvm->created_vcpus)));
> -	hyp_vm = alloc_pages_exact(hyp_vm_sz, GFP_KERNEL_ACCOUNT);
> -	if (!hyp_vm) {
> -		ret = -ENOMEM;
> -		goto free_pgd;
> -	}
> -
> -	/* Donate the VM memory to hyp and let hyp initialize it. */
> -	ret = kvm_call_hyp_nvhe(__pkvm_init_vm, kvm, hyp_vm, pgd);
> +	ret = pkvm_call_hyp_req(__pkvm_init_vm, kvm, pgd);

[Severity: High]
Does this change bypass memory cgroup accounting for the VM structure?

The previous implementation explicitly used GFP_KERNEL_ACCOUNT to charge the
allocation to the calling process. By migrating the allocation to the
hypervisor, the memory is now satisfied by the host's unaccounted top-up
path.

When the hypervisor needs more memory and returns a top-up request, the
host handles this in pkvm_hyp_topup() using a temporary memcache:

arch/arm64/kvm/pkvm.c:pkvm_hyp_topup() {
    ...
    init_hyp_memcache(&mc);
    ret = topup_hyp_memcache(&mc, nr_pages);
    ...
}

Because init_hyp_memcache() clears all flags and drops
HYP_MEMCACHE_ACCOUNT_KMEMCG, top-up pages are allocated with GFP_KERNEL
instead of GFP_KERNEL_ACCOUNT.

Since KVM relies on memcg limits rather than static quotas to constrain VM
memory, could an unprivileged userspace process bypass its container memory
limits by creating numerous VMs, potentially exhausting host kernel memory
and causing a denial of service?

>  	if (ret)
> -		goto free_vm;
> +		goto free_pgd;
>  
>  	kvm->arch.pkvm.is_created = true;
>  	init_hyp_stage2_memcache(&kvm->arch.pkvm.stage2_teardown_mc);
>  	kvm_account_pgtable_pages(pgd, pgd_sz / PAGE_SIZE);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001142849.3367614-1-vdonnefort@google.com?part=13