From: Greg KH <greg@kroah.com>
To: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org, Sean Christopherson <seanjc@google.com>,
Jinwoo Lee <rkskek9254@gmail.com>,
Stefan Teodorescu <fane@google.com>
Subject: Re: [PATCH 6.18.y 4/4] KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths
Date: Wed, 7 Oct 2026 08:40:40 +0200 [thread overview]
Message-ID: <2026100736-rack-shimmy-fe09@gregkh> (raw)
In-Reply-To: <20260930153934.2895211-4-sashal@kernel.org>
On Wed, Sep 30, 2026 at 11:39:34AM -0400, Sasha Levin wrote:
> From: Sean Christopherson <seanjc@google.com>
>
> [ Upstream commit c1214f293d77c6e425a379f90d09bdb4815993a8 ]
>
> Fill kvm_run with "internal error, emulation" in the common error handling
> paths for getting nested state pages, as requiring each check to manually
> fill kvm_run is error prone and requires a non-trivial amount of copy+paste.
>
> Specifically, both SVM and VMX fail to fill kvm_run if load_pdptrs() fails,
> and SVM fails to fill kvm_run if kvm_hv_verify_vp_assist() fails. If those
> flows fail, the *best* case scenario is that KVM will exit to userspace
> with KVM_EXIT_UNKNOWN. The worst case scenario is that KVM exits with a
> stale exit_reason and confuses userspace.
>
> Note, SVM never exits to userspace if something goes sideways when dealing
> with vmcb12 assets while emulating VMRUN, i.e. lack of SVM-specific code is
> not a bug.
>
> Fixes: 0f85722341b0 ("KVM: nVMX: delay loading of PDPTRs to KVM_REQ_GET_NESTED_STATE_PAGES")
> Fixes: 232f75d3b4b5 ("KVM: nSVM: call nested_svm_load_cr3 on nested state load")
> Fixes: 3f4a812edf5c ("KVM: nSVM: hyper-v: Enable L2 TLB flush")
> Cc: stable@vger.kernel.org
> Reported-by: Jinwoo Lee <rkskek9254@gmail.com>
> Closes: https://lore.kernel.org/all/20260813043932.3214460-1-rkskek9254@gmail.com
> Reported-by: Stefan Teodorescu <fane@google.com>
> Link: https://patch.msgid.link/20260921211608.1030158-3-seanjc@google.com
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> arch/x86/kvm/svm/nested.c | 7 +------
> arch/x86/kvm/vmx/nested.c | 15 +++++----------
> arch/x86/kvm/x86.c | 3 +++
> 3 files changed, 9 insertions(+), 16 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index c765ea1dff69c..a6b92819318b8 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1953,13 +1953,8 @@ static bool svm_get_nested_state_pages(struct kvm_vcpu *vcpu)
> return false;
> }
>
> - if (!nested_svm_merge_msrpm(vcpu)) {
> - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> - vcpu->run->internal.suberror =
> - KVM_INTERNAL_ERROR_EMULATION;
> - vcpu->run->internal.ndata = 0;
> + if (!nested_svm_merge_msrpm(vcpu))
> return false;
> - }
>
> if (kvm_hv_verify_vp_assist(vcpu))
> return false;
> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index cb44ae23728b3..890ee82af35d6 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -3492,10 +3492,6 @@ static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
> } else {
> pr_debug_ratelimited("%s: no backing for APIC-access address in vmcs12\n",
> __func__);
> - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> - vcpu->run->internal.suberror =
> - KVM_INTERNAL_ERROR_EMULATION;
> - vcpu->run->internal.ndata = 0;
> return false;
> }
> }
> @@ -3566,11 +3562,6 @@ static bool vmx_get_nested_state_pages(struct kvm_vcpu *vcpu)
> if (!nested_get_evmcs_page(vcpu)) {
> pr_debug_ratelimited("%s: enlightened vmptrld failed\n",
> __func__);
> - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> - vcpu->run->internal.suberror =
> - KVM_INTERNAL_ERROR_EMULATION;
> - vcpu->run->internal.ndata = 0;
> -
> return false;
> }
> #endif
> @@ -3956,8 +3947,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
>
> vmentry_failed:
> vcpu->arch.nested_run_pending = 0;
> - if (status == NVMX_VMENTRY_KVM_INTERNAL_ERROR)
> + if (status == NVMX_VMENTRY_KVM_INTERNAL_ERROR) {
> + vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> + vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
> + vcpu->run->internal.ndata = 0;
> return 0;
> + }
> if (status == NVMX_VMENTRY_VMEXIT)
> return 1;
> WARN_ON_ONCE(status != NVMX_VMENTRY_VMFAIL);
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 69d48df5d1d89..c86b828ca578a 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -10708,6 +10708,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
>
> if (kvm_check_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu)) {
> if (unlikely(!kvm_nested_call(get_nested_state_pages)(vcpu))) {
> + vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> + vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
> + vcpu->run->internal.ndata = 0;
> kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
> r = 0;
> goto out;
> --
> 2.53.0
>
>
Did not apply :(
prev parent reply other threads:[~2026-10-07 6:42 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-29 11:38 FAILED: patch "[PATCH] KVM: x86: Fill kvm_run exit fields in common" failed to apply to 6.18-stable tree gregkh
2026-09-30 15:39 ` [PATCH 6.18.y 1/4] KVM: move TSS constants from kvm_host.h to tss.h Sasha Levin
2026-09-30 15:39 ` [PATCH 6.18.y 2/4] KVM: x86: Reject nested CAP enablement if nested virtualization is disabled Sasha Levin
2026-09-30 15:39 ` [PATCH 6.18.y 3/4] KVM: x86: Add static calls for nested virtualization ops Sasha Levin
2026-09-30 15:39 ` [PATCH 6.18.y 4/4] KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths Sasha Levin
2026-10-07 6:40 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026100736-rack-shimmy-fe09@gregkh \
--to=greg@kroah.com \
--cc=fane@google.com \
--cc=rkskek9254@gmail.com \
--cc=sashal@kernel.org \
--cc=seanjc@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.