Re: [PATCH 1/2] KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: vmx: nested state corruption (CR0/CR4/EFER) on KVM_SET_NESTED_STATE failure
--

commit 55d55918900f4eae4bf7636855cdc83ba4433cf5
Author: Amirmohammad Eftekhar <amirmohammadeftekhar@gmail.com>

KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

This patch resets the vCPU's MMU pointer back to the root MMU if loading L2
state fails when not coming from VM-Entry. This prevents KVM from hitting
a NULL pointer dereference when attempting to run L1 with a nested MMU.

Link: https://patch.msgid.link/20261001214356.3825100-2-seanjc@google.com

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index b252168627408..5165275128fce 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -3770,8 +3770,10 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,
>  vmentry_fail_vmexit:
>  	vmx_switch_vmcs(vcpu, &vmx->vmcs01);
>  
> -	if (!from_vmentry)
> +	if (!from_vmentry) {
> +		nested_ept_uninit_mmu_context(vcpu);

[Severity: High]
When userspace invokes KVM_SET_NESTED_STATE, KVM executes
vmx_set_nested_state() which calls nested_vmx_enter_non_root_mode() with
from_vmentry set to false.

This unconditionally calls prepare_vmcs02(), which modifies the vCPU's
software state (such as cr0, cr4, efer, and tsc_offset) to match the
nested L2 state.

If prepare_vmcs02() subsequently fails, for example due to an invalid L2
CR3, it returns an error and jumps to vmentry_fail_vmexit_guest_mode.

While this patch fixes the MMU pointer, since from_vmentry is false, does
this early return bypass load_vmcs12_host_state() and leave the vCPU's
software state permanently corrupted with L2's values?

>  		return NVMX_VMENTRY_VMEXIT;
> +	}
>  
>  	nested_put_vmcs12_pages(vcpu);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015083123.790030-1-pbonzini@redhat.com?part=1