Re: [PATCH] KVM: x86: Drop WARN_ON_ONCE() for concurrently disappearing interrupts

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Guest-triggerable host log spam via pr_err_ratelimited() for a normal TOCTOU condition.
--

commit 116bec97d294fdbb66935efe3243c46e486faba6
Author: Alexander Potapenko <[email protected]>

KVM: x86: Drop WARN_ON_ONCE() for concurrently disappearing interrupts

This commit removes a warning in kvm_check_and_inject_events() that occurs
when an interrupt disappears between being checked and fetched. Since this
is a legitimate race condition, the warning is replaced with a rate-limited
error message.

Link: https://syzkaller.appspot.com/ai_job?id=35cad3cd-95fd-4c0d-8ca8-812f58d56e59

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 0550359ed798f..c5b4cddd9c0cb 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -10857,10 +10857,13 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
>  		if (r) {
>  			int irq = kvm_cpu_get_interrupt(vcpu);
>  
> -			if (!WARN_ON_ONCE(irq == -1)) {
> +			if (irq != -1) {
>  				kvm_queue_interrupt(vcpu, irq, false);
>  				kvm_x86_call(inject_irq)(vcpu, false);
>  				WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0);
> +			} else {
> +				pr_err_ratelimited(
> +					"KVM: interrupt disappeared between checking and fetching\n");

[Severity: Medium]
Since the commit message identifies this as a legitimate race condition that
can occur during normal operation, could this pr_err_ratelimited() allow an
unprivileged guest to continuously spam the host kernel log?

By configuring a PIT or PCI device to rapidly assert and deassert
level-triggered interrupts, a guest could intentionally trigger this path and
force the host to log messages at the maximum rate-limited frequency
indefinitely.

Should this event be logged with pr_warn_once() instead, or dropped entirely
to prevent adversary-reachable host log pollution?

> +			}
>  		}
>  		if (kvm_cpu_has_injectable_intr(vcpu))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1