Re: [PATCH 5.15.y v2 4/8] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch introduces a guest-triggerable WARN_ON_ONCE in mmu_alloc_root(), which causes a host denial of service (DoS) when panic_on_warn is enabled.
--

commit 8c0238e94cdb540684953deca3c7dac664d9db92
Author: Paolo Bonzini <pbonzini@redhat.com>

KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes

This commit simplifies quadrant passing for PAE page directories by only
passing a non-zero quadrant when actually necessary. It also adds sanity
warnings to enforce these invariants.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 3a5ed96703776..dbc18d4cc572c 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -3444,9 +3444,10 @@ static hpa_t mmu_alloc_root(struct kvm_vcpu *vcpu, gfn_t gfn, int quadrant,
>  	struct kvm_mmu_page *sp;
>  
>  	role.level = level;
> +	role.quadrant = quadrant;
>  
> -	if (!role.gpte_is_8_bytes)
> -		role.quadrant = quadrant;
> +	WARN_ON_ONCE(quadrant && role.gpte_is_8_bytes);
> +	WARN_ON_ONCE(role.direct && !role.gpte_is_8_bytes);

[Severity: High]
Does this new assertion assume that direct-mapped roots only occur with TDP?

When a guest runs with paging disabled (CR0.PG=0) on a host using the shadow
MMU, KVM operates the shadow MMU in a direct-mapped configuration. In this
context, kvm_calc_shadow_mmu_root_page_role() sets role.base.direct = 1 and
role.base.gpte_is_8_bytes = 0.

When KVM loads the MMU context, it invokes mmu_alloc_direct_roots(), which
subsequently calls mmu_alloc_root(). Under these conditions, the new
assertion evaluates to true and triggers unconditionally.

Since this path is reachable during a normal guest boot sequence, or
maliciously by a guest repeatedly disabling paging, could a guest use this to
trigger host warnings or kernel panics when panic_on_warn is enabled?

>  
>  	sp = kvm_mmu_get_page(vcpu, gfn, role);
>  	++sp->root_count;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626174620.1819772-1-pbonzini@redhat.com?part=4