Re: [PATCH 2/3] KVM: x86: Reject enabling KVM_CAP_X86_BUS_LOCK_EXIT when !kvm_caps.has_bus_lock_exit

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Modifying the VM-wide state `kvm->arch.bus_lock_detection_enabled` lacks protection from `kvm->lock` and does not verify that no vCPUs have been created yet.
--

--- Patch [2]: [PATCH 2/3] KVM: x86: Reject enabling KVM_CAP_X86_BUS_LOCK_EXIT when !kvm_caps.has_bus_lock_exit ---
commit e0edfcdc943c7835281cad8477ff3399dfe81a05
Author: Xiaoyao Li <[email protected]>

KVM: x86: Reject enabling KVM_CAP_X86_BUS_LOCK_EXIT when !kvm_caps.has_bus_lock_exit

This commit returns -EINVAL to reject enabling KVM_CAP_X86_BUS_LOCK_EXIT
or KVM_BUS_LOCK_DETECTION_OFF from userspace when kvm_caps.has_bus_lock_exit
is false. It aims to keep the API behavior consistent when KVM does not
support bus lock exit.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index afcac1042947a..91895a3d6f857 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6835,8 +6835,10 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>  		    (cap->args[0] & KVM_BUS_LOCK_DETECTION_EXIT))
>  			break;
>  
> -		if (kvm_caps.has_bus_lock_exit &&
> -		    cap->args[0] & KVM_BUS_LOCK_DETECTION_EXIT)
> +		if (!kvm_caps.has_bus_lock_exit)
> +			break;
> +
> +		if (cap->args[0] & KVM_BUS_LOCK_DETECTION_EXIT)
>  			kvm->arch.bus_lock_detection_enabled = true;

[Severity: High]
This is a pre-existing issue, but does setting the VM-wide flag
bus_lock_detection_enabled here in kvm_vm_ioctl_enable_cap() require
kvm->lock protection and a check for !kvm->created_vcpus?

If userspace calls KVM_ENABLE_CAP for KVM_CAP_X86_BUS_LOCK_EXIT concurrently
with or after KVM_CREATE_VCPU, existing vCPUs might miss the update. This
could lead to an inconsistent state where some vCPUs mitigate bus lock DoS
and others do not, leaving the host vulnerable.

>  		r = 0;
>  		break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2