Re: [PATCH v6 32/33] KVM: s390: arm64: Implement basic page fault handler

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Guest-triggerable KVM_BUG on unexpected program interrupt codes (PICs) causes host denial of service.
--

--- Patch [32]: [PATCH v6 32/33] KVM: s390: arm64: Implement basic page fault handler ---
commit 1cc2a3fc0641697d83c316659559bcf0aaa389a1
Author: Steffen Eiden <[email protected]>

KVM: s390: arm64: Implement basic page fault handler

Add host functionality to page in guest memory. If the guest does
something unexpected or illegal exit to userspace abort guest execution.

> diff --git a/arch/s390/kvm/arm64/mmu.c b/arch/s390/kvm/arm64/mmu.c
> new file mode 100644
> index 0000000000000..71cd582f24ff8
> --- /dev/null
> +++ b/arch/s390/kvm/arm64/mmu.c
[ ... ]
> +static int kvm_handle_pic(struct kvm_vcpu *vcpu, bool *translation)
> +{
> +	switch (kvm_vcpu_fault_pic(vcpu)) {
> +	/* expected cases: */
> +	case PGM_ASCE_TYPE:
> +	case PGM_REGION_FIRST_TRANS:
> +	case PGM_REGION_SECOND_TRANS:
> +	case PGM_REGION_THIRD_TRANS:
> +	case PGM_SEGMENT_TRANSLATION:
> +	case PGM_PAGE_TRANSLATION:
> +		*translation = true;
> +		break;
> +	case PGM_PROTECTION:
> +		break;
> +	/* unexpected cases: */
> +	case 0:
> +		KVM_BUG(1, vcpu->kvm, "On MMU fault path but no fault occurred");

[Severity: High]
Does this KVM_BUG() allow a guest to trigger a host warning?

If a guest performs an action that triggers a hardware exit with an
unexpected program interrupt code (like an alignment fault that exits with
pic == 0), kvm_handle_pic() falls into these branches.

Since KVM_BUG() expands to a WARN_ONCE in the host kernel, this could
cause a host kernel panic on systems configured with panic_on_warn.

Should this cleanly return -EFAULT to userspace to gracefully abort the
guest without asserting instead?

> +		return -EFAULT;
> +	default:
> +		KVM_BUG(1, vcpu->kvm, "Unexpected program interrupt 0x%x, TEID 0x%016lx",
> +			vcpu->arch.sae_block.hai.pic, vcpu->arch.sae_block.hai.teid.val);
> +		send_sig(SIGSEGV, current, 0);
> +		return -EFAULT;
> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=32