KVM: x86: Suppress WARNs on nested_run_pending after userspace exit

Browse source

To end an ongoing game of whack-a-mole between KVM and syzkaller, WARN on
illegally cancelling a pending nested VM-Enter if and only if userspace
has NOT gained control of the vCPU since the nested run was initiated.  As
proven time and time again by syzkaller, userspace can clobber vCPU state
so as to force a VM-Exit that violates KVM's architectural modelling of
VMRUN/VMLAUNCH/VMRESUME.

To detect that userspace has gained control, while minimizing the risk of
operating on stale data, convert nested_run_pending from a pure boolean to
a tri-state of sorts, where '0' is still "not pending", '1' is "pending",
and '2' is "pending but untrusted".  Then on KVM_RUN, if the flag is in
the "trusted pending" state, move it to "untrusted pending".

Note, moving the state to "untrusted" even if KVM_RUN is ultimately
rejected is a-ok, because for the "untrusted" state to matter, KVM must
get past kvm_x86_vcpu_pre_run() at some point for the vCPU.

Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260312234823.3120658-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

...

This commit is contained in:

Sean Christopherson 2026-03-12 16:48:23 -07:00

parent 3d4470d71f

commit 7212094bae

7 changed files with 40 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

arch/x86/include/asm/kvm_host.h

View file

11

arch/x86/kvm/svm/nested.c

View file

2

arch/x86/kvm/svm/svm.c

View file

12

arch/x86/kvm/vmx/nested.c

View file

2

arch/x86/kvm/vmx/vmx.c

View file

7

arch/x86/kvm/x86.c

View file

10

arch/x86/kvm/x86.h

View file