Re: [PATCH 07/24] KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Guest-triggerable non-ratelimited `pr_err` messages can be spammed to flood the host logs, leading to a host-side DoS.
--

commit f2dbe3638336199969535efb957ca83d946dd1f5
Author: Sean Christopherson <seanjc@google.com>

KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
    
This commit adds a warning when KVM attempts to configure the scratch area 
with a minimum length of zero. This guards against future bugs, as all
paths are now expected to provide a valid, non-zero length.

Link: https://lkml.kernel.org/r/20260501202250.2115252-8-seanjc@google.com

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3669,6 +3669,9 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len)
>  	u64 scratch_gpa_beg, scratch_gpa_end;
>  	void *scratch_va;
>  
> +	if (WARN_ON_ONCE(!min_len))
> +		goto e_scratch;
> +
>  	scratch_gpa_beg = svm->sev_es.sw_scratch;
>  	if (!scratch_gpa_beg) {
>  		pr_err("vmgexit: scratch gpa not provided\n");

[Severity: High]
This is a pre-existing issue, but could a malicious SEV-ES guest intentionally
provide a malformed scratch GPA and repeatedly issue VMGEXIT requests in a
tight loop?

Since this pr_err in setup_vmgexit_scratch is not rate-limited, the continuous
VM exits might flood the host kernel log. Would it be safer to convert
guest-triggerable log messages like this one to use vcpu_unimpl or
pr_err_ratelimited to prevent host-side log spam?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529183549.1104619-1-pbonzini@redhat.com?part=7