Re: [PATCH v6 14/18] KVM: arm64: Alloc pkvm_hyp_vcpu using pKVM heap allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] mm: memcg accounting bypass for pkvm_hyp_vcpu in pKVM heap top-up
--

commit 21d00ea4fd8fbddce7df56c53bb28890af94ad7f
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Alloc pkvm_hyp_vcpu using pKVM heap allocator

This commit transitions the allocation of the hypervisor vCPU state structure
to EL2 using the new pKVM heap allocator. The host now uses
pkvm_call_hyp_req() to invoke __pkvm_create_hyp_vcpu, handling any EL2 memory
top-ups automatically.

> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 8505965dbfb21..36e677e51f7d6 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
[ ... ]
> @@ -174,28 +174,19 @@ static void __pkvm_destroy_hyp_vm(struct kvm *kvm)
>  
>  static int __pkvm_create_hyp_vcpu(struct kvm_vcpu *vcpu)
>  {
> -	size_t hyp_vcpu_sz = PAGE_ALIGN(PKVM_HYP_VCPU_SIZE);
>  	pkvm_handle_t handle = vcpu->kvm->arch.pkvm.handle;
> -	void *hyp_vcpu;
>  	int ret;
>  
>  	init_hyp_stage2_memcache(&vcpu->arch.pkvm_memcache);
>  
> -	hyp_vcpu = alloc_pages_exact(hyp_vcpu_sz, GFP_KERNEL_ACCOUNT);
> -	if (!hyp_vcpu)
> -		return -ENOMEM;
> -
> -	ret = kvm_call_hyp_nvhe(__pkvm_init_vcpu, handle, vcpu, hyp_vcpu);
> +	ret = pkvm_call_hyp_req(__pkvm_init_vcpu, handle, vcpu);

[Severity: Medium]
Does this replace an accounted host allocation with an unaccounted EL2 top-up?

Previously, pkvm_hyp_vcpu was allocated directly by the host using
GFP_KERNEL_ACCOUNT. Now, it triggers an EL2 allocation which, if it runs
out of memory, requests a top-up via PKVM_HYP_REQ_HYP_ALLOC.

The host handles this top-up request in pkvm_hyp_topup() using:

	init_hyp_memcache(&mc);
	ret = topup_hyp_memcache(&mc, nr_pages);

Because init_hyp_memcache() initializes mc->flags to 0, it omits the
HYP_MEMCACHE_ACCOUNT_KMEMCG flag. This causes the allocation in
hyp_mc_alloc_fn() to use GFP_KERNEL instead of GFP_KERNEL_ACCOUNT:

	gfp = memcache->flags & HYP_MEMCACHE_ACCOUNT_KMEMCG ?
		GFP_KERNEL_ACCOUNT : GFP_KERNEL;

Can an unprivileged userspace attacker exploit this by repeatedly creating
KVM virtual machines and vCPUs to bypass memory cgroup limits and exhaust
host memory?

>  	if (!ret)
>  		vcpu_set_flag(vcpu, VCPU_PKVM_FINALIZED);
> -	else
> -		free_pages_exact(hyp_vcpu, hyp_vcpu_sz);
>  
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001142849.3367614-1-vdonnefort@google.com?part=14