Re: [PATCH v2 15/18] KVM: arm64: Alloc pkvm_hyp_vm using pKVM heap allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Memcg accounting bypass in EL2 heap top-up allows host memory exhaustion
--

commit 66032df021feb40dc76572f7b2d6e0341f8b7e65
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Alloc pkvm_hyp_vm using pKVM heap allocator

Transition the allocation of the hypervisor VM state structure
(pkvm_hyp_vm) from the host to the hypervisor using the new pKVM heap
allocator (hyp_alloc()).

> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index f7e1846d6093f..8a8b5b84825c7 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
[ ... ]
> @@ -209,28 +209,15 @@ static int __pkvm_create_hyp_vm(struct kvm *kvm)
>  	if (!pgd)
>  		return -ENOMEM;
>  
> -	/* Allocate memory to donate to hyp for vm and vcpu pointers. */
> -	hyp_vm_sz = PAGE_ALIGN(size_add(PKVM_HYP_VM_SIZE,
> -					size_mul(sizeof(void *),
> -						 kvm->created_vcpus)));
> -	hyp_vm = alloc_pages_exact(hyp_vm_sz, GFP_KERNEL_ACCOUNT);
> -	if (!hyp_vm) {
> -		ret = -ENOMEM;
> -		goto free_pgd;
> -	}
> -
> -	/* Donate the VM memory to hyp and let hyp initialize it. */
> -	ret = kvm_call_hyp_nvhe(__pkvm_init_vm, kvm, hyp_vm, pgd);
> +	ret = pkvm_call_hyp_req(__pkvm_init_vm, kvm, pgd);

[Severity: High]
Does this change bypass memory cgroup accounting for the VM allocation?

Previously, the host allocated hyp_vm using GFP_KERNEL_ACCOUNT. With this
patch, the allocation is deferred to EL2, and if the EL2 heap is
depleted, it triggers a top-up request handled by pkvm_call_hyp_req()
and pkvm_hyp_topup() on the host.

Looking at how pkvm_hyp_topup() initializes the memcache:

init_hyp_memcache(&mc);
ret = topup_hyp_memcache(&mc, nr_pages);

The init_hyp_memcache() helper zeros the memcache flags, meaning it omits
the HYP_MEMCACHE_ACCOUNT_KMEMCG flag. As a result, the subsequent host page
allocations in hyp_mc_alloc_fn() will use a plain GFP_KERNEL without
__GFP_ACCOUNT.

Could an unprivileged container repeatedly trigger KVM_CREATE_VM to exhaust
host memory without being restricted by its memory cgroup limits?

>  	if (ret)
> -		goto free_vm;
> +		goto free_pgd;
>  
>  	kvm->arch.pkvm.is_created = true;
>  	init_hyp_stage2_memcache(&kvm->arch.pkvm.stage2_teardown_mc);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706175415.2604046-1-vdonnefort@google.com?part=15