Re: [PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes an infinite VM-exit loop in `handle_vmptrld` by injecting a `#UD` exception when eVMCS is active, but misses the identical pre-existing bug in its sibling function `handle_vmptrst`. This problem wasn't introduced by this patch, but represents an incomplete fix for the class of bugs described in the commit message.
--

--- Patch [1]: [PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used ---
commit 34f5c31113003a4163d028b0ce4bfea669ca97f5
Author: Vitaly Kuznetsov <[email protected]>

KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used
    
This commit updates the VMPTRLD emulation to inject a #UD exception when
eVMCS is active, rather than returning 1 without skipping the instruction.
This resolves an issue where returning 1 without advancing the instruction
pointer would cause the L1 guest to get stuck in an infinite VM-exit loop.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 6957bb6f5cf7e..c78c67525ac9b 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -5883,6 +5883,12 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
>  	if (!nested_vmx_check_permission(vcpu))
>  		return 1;
>  
> +	/* Forbid normal VMPTRLD if Enlightened version was used */
> +	if (nested_vmx_is_evmptr12_valid(vmx)) {
> +		kvm_queue_exception(vcpu, UD_VECTOR);
> +		return 1;
> +	}
> +

[Severity: High]
This isn't a bug introduced by this patch, but does handle_vmptrst() need the
same fix?

Looking at handle_vmptrst() further down in arch/x86/kvm/vmx/nested.c, it
appears to have the identical pattern that this patch fixes for VMPTRLD:

    if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
        return 1;

Could this unhandled return cause the same infinite VM-exit loop if a guest
executes VMPTRST while eVMCS is active?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1