Re: [PATCH v2 6/6] KVM: selftests: Expect failure when trying to set EFER that violates vCPU model

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM: selftests: uninitialized sregs in test_sregs_lmsle()
--

commit 6277431d999ca1b09f23758ba28993921a931827
Author: Sean Christopherson <seanjc@google.com>

KVM: selftests: Expect failure when trying to set EFER that violates vCPU model

This commit updates test_host_initiated_lmsle() in svm_nested_efer_test.c to
expect KVM_SET_MSRS to reject EFER.LMSLE=1 when EFER_LMSLE_MBZ is enabled in
guest CPUID, and cleans up related comments in the test.

> diff --git a/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c b/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c
> index fa9cfe8b12427..bdec7cdb37146 100644
> --- a/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c
> +++ b/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c

[ ... ]

> @@ -222,11 +219,6 @@ static void test_sregs_lmsle(void)
>  	vm = vm_create_with_one_vcpu(&vcpu, NULL);
>  	vcpu_set_cpuid_feature(vcpu, X86_FEATURE_EFER_LMSLE_MBZ);
>  
> -	/*
> -	 * Unlike KVM_SET_MSRS, KVM_SET_SREGS runs the full set of guest CPUID
> -	 * checks, i.e. rejects EFER.LMSLE even though it's host-initiated.
> -	 */
> -	vcpu_sregs_get(vcpu, &sregs);
>  	TEST_ASSERT(!(sregs.efer & EFER_LMSLE), "EFER.LMSLE unexpectedly set");

[Severity: Medium]
Was removing vcpu_sregs_get(vcpu, &sregs) in test_sregs_lmsle() unintentional?

Without that call, the stack variable sregs is left uninitialized when
TEST_ASSERT() reads sregs.efer and when sregs.efer |= EFER_LMSLE is passed to
_vcpu_sregs_set(vcpu, &sregs):

tools/testing/selftests/kvm/x86/svm_nested_efer_test.c:test_sregs_lmsle() {
	struct kvm_vcpu *vcpu;
	struct kvm_sregs sregs;
	struct kvm_vm *vm;
	int rc;

	vm = vm_create_with_one_vcpu(&vcpu, NULL);
	vcpu_set_cpuid_feature(vcpu, X86_FEATURE_EFER_LMSLE_MBZ);

	TEST_ASSERT(!(sregs.efer & EFER_LMSLE), "EFER.LMSLE unexpectedly set");

	sregs.efer |= EFER_LMSLE;
	rc = _vcpu_sregs_set(vcpu, &sregs);
	...
}

In addition to reading uninitialized stack memory on the assertion, passing
an uninitialized struct kvm_sregs to KVM_SET_SREGS means KVM may reject the
ioctl due to garbage in other fields rather than specifically testing
rejection of EFER.LMSLE=1.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027224914.1574319-1-seanjc@google.com?part=6