Re: [PATCH 1/4] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] svm_set_nested_state() leaves the vCPU in an inconsistent nested state if nested_svm_load_cr3() fails.
--

commit c04793c5ea54cf0af42f1998cd2e7c8148705788
Author: Sean Christopherson <seanjc@google.com>

KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0

Reject KVM_SET_NESTED_STATE if the incoming L1 host state has an
impossible EFER combination of LMA=1 but LME=0. This prevents KVM from
consuming the illegal state when constructing the shadow MMU for L2.

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 73f37b050d0a0..49fb10ad1f9f6 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -2028,6 +2028,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
>  	if (!(save->cr0 & X86_CR0_PG) ||
>  	    !(save->cr0 & X86_CR0_PE) ||
>  	    (save->rflags & X86_EFLAGS_VM) ||
> +	    ((save->efer & EFER_LMA) && !(save->efer & EFER_LME)) ||
>  	    !nested_vmcb_check_save(vcpu, &save_cached, false))
>  		goto out_free;
>  

[Severity: High]
This isn't a bug introduced by this patch, but looking further down in
svm_set_nested_state(), does this code leave the vCPU in an inconsistent
state if nested_svm_load_cr3() fails?

arch/x86/kvm/svm/nested.c:svm_set_nested_state() {
...
	ret = nested_svm_load_cr3(&svm->vcpu, vcpu->arch.cr3,
				  nested_npt_enabled(svm), false);
	if (ret)
		goto out_free;
...
}

If nested_svm_load_cr3() fails, the function jumps to out_free and returns
an error without unwinding the guest mode state transitions that occurred
earlier in the function.

The vCPU is left in guest mode with svm->vmcb pointing to vmcb02, but the
MMU is not re-initialized for the nested guest because it returns before
calling kvm_init_mmu().

Will a subsequent KVM_RUN ioctl attempt to execute the vCPU with mismatched
VMCB and MMU state?

Could an unprivileged host userspace process trigger this intentionally to
corrupt KVM internal state and crash the host?

For example, could userspace call KVM_SET_CPUID to set a high MAXPHYADDR,
call KVM_SET_SREGS with a CR3 near that limit, and then call KVM_SET_CPUID
again to lower MAXPHYADDR? This would make the previously set vcpu->arch.cr3
illegal, causing nested_svm_load_cr3() to fail its kvm_vcpu_is_legal_cr3()
check and return -EINVAL during KVM_SET_NESTED_STATE.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826211844.884951-1-seanjc@google.com?part=1