From nobody Wed Apr 8 04:44:48 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0611E3C140C for ; Tue, 10 Mar 2026 22:45:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773182756; cv=none; b=aDYvuHYkYc99dE0jjfPPODoi/tAA2rqMxgQsdakfWS+SGoOBEQflyd6auyBxEFdmuGW43t1zslB8uPWrFms/i/lP2zTusS9BlJt4a9PpmgtVU3swWm2bsAfwT9hniqnFgqajuRAEXwHZzRGKSHJRXDbSdlK7efGR6zczp1JMU3w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773182756; c=relaxed/simple; bh=FZWkyRtDd5sYp24vsvD+gZbVOVt0EAV2B3Zfqrqy1QI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Ry/Jk6AKxdn94cKEYJ3M3lIJW4NhdNNu6GKUk0IFbK6pBxgoWW36Ps9f3sXw5ekrqcBMrcuzgtRAniZkLa995/HE5vYUqFrTJLf5NJ8sAv8sjczFbD/qGCVg8alkj3/DcUktOY4687HF5n8B1eOWCzJ2flHYQaTEK5FmKMHDYz8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=oKsB0MKT; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="oKsB0MKT" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2ae57228f64so98569925ad.0 for ; Tue, 10 Mar 2026 15:45:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1773182753; x=1773787553; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=hvcwGyyqhhK+9ujMD1DpAI6luR3guQH7bK6OSfrMLVU=; b=oKsB0MKTMYAaEsfXUJRY59/k2J7dBzZW5a7uyLiqZftSm1n2/FDnoClcTt9Qpb4smQ SkAxwVrMrVy+JO+ewopSvvmMTTLt4DWbu/TpalHGtKQgOt0+Ym71U1MLQBEDABmyYpPx 7+nxu59KpjlP+RJo5WCKNTxXwNvmViSvLibjJn2vECICmALJb2FUl5EFg3PR4TTt4Rix Hy3ian7fkbUPXQnmzWXV45+3dHeJSDa42r79KZ+oz+1Xz671bws3FB/el+8BRGskxWsz y+8I6Y5QY8bO763UsXVtdz+aQw3l3Sf1k31URK9K0ihuXo8TdZDnWmOJ6HIN9rGz1dQx bdyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773182753; x=1773787553; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=hvcwGyyqhhK+9ujMD1DpAI6luR3guQH7bK6OSfrMLVU=; b=xPRlKvnoLV+AMnoT0UI7uHCLkwcizrE+TVmBBxre1cu4yPF2YSF/LtfMtsiqQApL7q K/xiOH2r7mwWzth1oQD99IRgcUmcF+OGUI733vRlXinZEyXy7lrziChtDaMhOYe3wOvJ qm25kM9xAsN8BJmXr2p1aGOVvLc0GDvRe/plRyiaFBOR5NsB/hdC5ROyedt+q1baJgDb sS4aNm6FDYMCNStPH8kiMjh0waJgVdfTaHBAIeJGAwuOBygSWRmieWUhQK95CZlTpw0D 7WUZZiuyRD2tv2IBKWqc7V6ngGo25aPBt6Dqua4cerpB4jO8pnQiG05UQNM4IoaZZjyl sUoA== X-Forwarded-Encrypted: i=1; AJvYcCUpLA+zU4ViKK2Ne8MnZ4KmQ/yKvH0Zb4ZjkV4jbjguBv6soxt3zzCfhJlkZYX3keK0R3yd5+wEBQj5A84=@vger.kernel.org X-Gm-Message-State: AOJu0Yy67zH2WoCp2CsiVXfm+PBICz3+ql6qZKUoY6Muq5Z9PYj77ZKe 7+WrpQN7dkywL9dRTM2BKp8iiIZWa8+vyaG6zkVRDSaNwPZoRXVSEvV2UVrtF0GVmY+Z6EEAhfT NCQui+A== X-Received: from pgbdp14.prod.google.com ([2002:a05:6a02:f0e:b0:c73:84bb:9d81]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:e888:b0:2ae:467f:11d8 with SMTP id d9443c01a7336-2aeae891e96mr3395745ad.30.1773182753192; Tue, 10 Mar 2026 15:45:53 -0700 (PDT) Reply-To: Sean Christopherson Date: Tue, 10 Mar 2026 15:45:46 -0700 In-Reply-To: <20260310224546.2582118-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260310224546.2582118-1-seanjc@google.com> X-Mailer: git-send-email 2.53.0.473.g4a7958ca14-goog Message-ID: <20260310224546.2582118-3-seanjc@google.com> Subject: [PATCH 2/2] KVM: x86: Suppress WARNs on nested_run_pending after userspace exit From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" To end an ongoing game of whack-a-mole between KVM and syzkaller, WARN on illegally cancelling a pending nested VM-Enter if and only if userspace has NOT gained control of the vCPU since the nested run was initiated. As proven time and time again by syzkaller, userspace can clobber vCPU state so as to force a VM-Exit that violates KVM's architectural modelling of VMRUN/VMLAUNCH/VMRESUME. To detect that userspace has gained control, while minimizing the risk of operating on stale data, convert nested_run_pending from a pure boolean to a tri-state of sorts, where '0' is still "not pending", '1' is "pending", and '2' is "pending but untrusted". Then on KVM_RUN, if the flag is in the "trusted pending" state, move it to "untrusted pending". Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/include/asm/kvm_host.h | 8 +++++++- arch/x86/kvm/svm/nested.c | 11 +++++++---- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/vmx/nested.c | 12 +++++++----- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/x86.c | 7 +++++++ arch/x86/kvm/x86.h | 10 ++++++++++ 7 files changed, 40 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_hos= t.h index a1bf0aaedad8..acec03d7bb1e 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1105,8 +1105,14 @@ struct kvm_vcpu_arch { * can only occur at instruction boundaries. The only exception is * VMX's "notify" exits, which exist in large part to break the CPU out * of infinite ucode loops, but can corrupt vCPU state in the process! + * + * For all intents and purposes, this is a boolean, but it's tracked as + * a u8 so that KVM can detect when userspace may have stuffed vCPU + * state and generated an architecturally-impossible VM-Exit. */ - bool nested_run_pending; +#define KVM_NESTED_RUN_PENDING 1 +#define KVM_NESTED_RUN_PENDING_UNTRUSTED 2 + u8 nested_run_pending; =20 #if IS_ENABLED(CONFIG_HYPERV) hpa_t hv_root_tdp; diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 782d6a34d173..af741823c08c 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1131,7 +1131,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) if (!npt_enabled) vmcb01->save.cr3 =3D kvm_read_cr3(vcpu); =20 - vcpu->arch.nested_run_pending =3D 1; + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING; =20 if (enter_svm_guest_mode(vcpu, vmcb12_gpa, true) || !nested_svm_merge_msrpm(vcpu)) { @@ -1277,7 +1277,8 @@ void nested_svm_vmexit(struct vcpu_svm *svm) /* Exit Guest-Mode */ leave_guest_mode(vcpu); svm->nested.vmcb12_gpa =3D 0; - WARN_ON_ONCE(vcpu->arch.nested_run_pending); + + kvm_warn_on_nested_run_pending(vcpu); =20 kvm_clear_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); =20 @@ -1984,8 +1985,10 @@ static int svm_set_nested_state(struct kvm_vcpu *vcp= u, =20 svm_set_gif(svm, !!(kvm_state->flags & KVM_STATE_NESTED_GIF_SET)); =20 - vcpu->arch.nested_run_pending =3D - !!(kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING); + if (kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING) + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING_UNTRUSTED; + else + vcpu->arch.nested_run_pending =3D 0; =20 svm->nested.vmcb12_gpa =3D kvm_state->hdr.svm.vmcb_pa; =20 diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 112731515ee3..7de2c6621b98 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5035,7 +5035,7 @@ static int svm_leave_smm(struct kvm_vcpu *vcpu, const= union kvm_smram *smram) if (ret) goto unmap_save; =20 - vcpu->arch.nested_run_pending =3D 1; + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING; =20 unmap_save: kvm_vcpu_unmap(vcpu, &map_save); diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 65e45cee871c..6a107025e7e2 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -3844,7 +3844,7 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool= launch) * We're finally done with prerequisite checking, and can start with * the nested entry. */ - vcpu->arch.nested_run_pending =3D 1; + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING; vmx->nested.has_preemption_timer_deadline =3D false; status =3D nested_vmx_enter_non_root_mode(vcpu, true); if (unlikely(status !=3D NVMX_VMENTRY_SUCCESS)) @@ -5056,7 +5056,7 @@ void __nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 v= m_exit_reason, vmx->nested.mtf_pending =3D false; =20 /* trying to cancel vmlaunch/vmresume is a bug */ - WARN_ON_ONCE(vcpu->arch.nested_run_pending); + kvm_warn_on_nested_run_pending(vcpu); =20 #ifdef CONFIG_KVM_HYPERV if (kvm_check_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu)) { @@ -6679,7 +6679,7 @@ bool nested_vmx_reflect_vmexit(struct kvm_vcpu *vcpu) unsigned long exit_qual; u32 exit_intr_info; =20 - WARN_ON_ONCE(vcpu->arch.nested_run_pending); + kvm_warn_on_nested_run_pending(vcpu); =20 /* * Late nested VM-Fail shares the same flow as nested VM-Exit since KVM @@ -6987,8 +6987,10 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcp= u, if (!(kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE)) return 0; =20 - vcpu->arch.nested_run_pending =3D - !!(kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING); + if (kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING) + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING_UNTRUSTED; + else + vcpu->arch.nested_run_pending =3D 0; =20 vmx->nested.mtf_pending =3D !!(kvm_state->flags & KVM_STATE_NESTED_MTF_PENDING); diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 0e7e0a17bb75..dbe0f234aefb 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8423,7 +8423,7 @@ int vmx_leave_smm(struct kvm_vcpu *vcpu, const union = kvm_smram *smram) if (ret) return ret; =20 - vcpu->arch.nested_run_pending =3D 1; + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING; vmx->nested.smm.guest_mode =3D false; } return 0; diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 879cdeb6adde..cad16c83dcff 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -12090,6 +12090,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) if (r <=3D 0) goto out; =20 + /* + * If userspace may have modified vCPU state, mark nested_run_pending + * as "untrusted" to avoid triggering false-positive WARNs. + */ + if (vcpu->arch.nested_run_pending =3D=3D KVM_NESTED_RUN_PENDING) + vcpu->arch.nested_run_pending =3D KVM_NESTED_RUN_PENDING_UNTRUSTED; + r =3D vcpu_run(vcpu); =20 out: diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 44a28d343d40..38a905fa86de 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -188,6 +188,16 @@ static inline bool kvm_can_set_cpuid_and_feature_msrs(= struct kvm_vcpu *vcpu) return vcpu->arch.last_vmentry_cpu =3D=3D -1 && !is_guest_mode(vcpu); } =20 +/* + * WARN if a nested VM-Enter is pending completion, and userspace hasn't g= ained + * control since the nested VM-Enter was initiated (in which case, userspa= ce + * may have modified vCPU state to induce an architecturally invalid VM-Ex= it). + */ +static inline void kvm_warn_on_nested_run_pending(struct kvm_vcpu *vcpu) +{ + WARN_ON_ONCE(vcpu->arch.nested_run_pending =3D=3D KVM_NESTED_RUN_PENDING); +} + static inline void kvm_set_mp_state(struct kvm_vcpu *vcpu, int mp_state) { vcpu->arch.mp_state =3D mp_state; --=20 2.53.0.473.g4a7958ca14-goog