Re: [PATCH 20/24] KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] KVM consumes the GHCB `sw_exit_code` field before verifying that the guest marked it as valid.
--

commit 96be1ee0d4433ce7c711162daac605e0cd3278ae
Author: Sean Christopherson <seanjc@google.com>

KVM: SEV: Return INVALID_EVENT for SNP-only #VMGEXIT from non-SNP guest

This commit updates the error signaled when a non-SNP guest attempts to
invoke an SNP-only #VMGEXIT to INVALID_EVENT instead of MISSING_INPUT.
It also moves the SNP checks out of sev_es_validate_vmgexit() to make it
solely a predicate for verifying GHCB fields.

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 880a2acd77bff..b59adddfdbccb 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
[ ... ]
> @@ -4527,6 +4537,13 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
>  		return 1;
>  	}
>  
> +	if (is_snp_only_vmgexit(control->exit_code) && !is_sev_snp_guest(vcpu)) {
> +		vcpu_unimpl(vcpu, "vmgexit: exit code %#llx is SNP-only\n",
> +			    control->exit_code);
> +		svm_vmgexit_bad_input(svm, GHCB_ERR_INVALID_EVENT);
> +		return 1;
> +	}
> +
>  	ret = sev_es_validate_vmgexit(svm);
>  	if (ret)
>  		return ret;

[Severity: Low]
Does this consume the GHCB sw_exit_code field before verifying that the
guest actually marked it as valid?

By moving the is_snp_only_vmgexit(control->exit_code) check before the
call to sev_es_validate_vmgexit(), KVM evaluates the exit code before
kvm_ghcb_sw_exit_code_is_valid() is checked.

If a non-SNP guest provides a GHCB without setting the valid bit for the
exit code, but the uninitialized memory coincidentally matches an SNP-only
exit code, will KVM incorrectly return GHCB_ERR_INVALID_EVENT instead of
the required GHCB_ERR_MISSING_INPUT?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529183549.1104619-1-pbonzini@redhat.com?part=20