Re: [PATCH MANUALSEL 5.15 4/8] KVM: nVMX: WARN on any attempt to allocate shadow VMCS for vmcs02

On 2/9/22 19:56, Sasha Levin wrote:

From: Sean Christopherson seanjc@google.com

[ Upstream commit d6e656cd266cdcc95abd372c7faef05bee271d1a ]

WARN if KVM attempts to allocate a shadow VMCS for vmcs02. KVM emulates VMCS shadowing but doesn't virtualize it, i.e. KVM should never allocate a "real" shadow VMCS for L2.

The previous code WARNed but continued anyway with the allocation, presumably in an attempt to avoid NULL pointer dereference. However, alloc_vmcs (and hence alloc_shadow_vmcs) can fail, and indeed the sole caller does:

if (enable_shadow_vmcs && !alloc_shadow_vmcs(vcpu)) goto out_shadow_vmcs;

which makes it not a useful attempt.

Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20220125220527.2093146-1-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org

---

arch/x86/kvm/vmx/nested.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index a0193b11c381d..42559c21fb2cc 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4840,18 +4840,20 @@ static struct vmcs *alloc_shadow_vmcs(struct kvm_vcpu *vcpu) struct loaded_vmcs *loaded_vmcs = vmx->loaded_vmcs; /*

• * We should allocate a shadow vmcs for vmcs01 only when L1
  

• * executes VMXON and free it when L1 executes VMXOFF.
  

• * As it is invalid to execute VMXON twice, we shouldn't reach
  

• * here when vmcs01 already have an allocated shadow vmcs.
  

• * KVM allocates a shadow VMCS only when L1 executes VMXON and frees it
  

• * when L1 executes VMXOFF or the vCPU is forced out of nested
  

• * operation.  VMXON faults if the CPU is already post-VMXON, so it
  

• * should be impossible to already have an allocated shadow VMCS.  KVM
  

• * doesn't support virtualization of VMCS shadowing, so vmcs01 should
  

• * always be the loaded VMCS.
  

  */

• WARN_ON(loaded_vmcs == &vmx->vmcs01 && loaded_vmcs->shadow_vmcs);

• if (WARN_ON(loaded_vmcs != &vmx->vmcs01 || loaded_vmcs->shadow_vmcs))

• return loaded_vmcs->shadow_vmcs;
  

• loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
• if (loaded_vmcs->shadow_vmcs)

• vmcs_clear(loaded_vmcs->shadow_vmcs);
  

• if (!loaded_vmcs->shadow_vmcs) {

• loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
  

• if (loaded_vmcs->shadow_vmcs)
  

• 	vmcs_clear(loaded_vmcs->shadow_vmcs);
  

• } return loaded_vmcs->shadow_vmcs; }

NACK

Paolo