[PATCH v2 00/10] KVM: Fix+harden against bad uaccess using dying VM · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 05/10] KVM: Destroy memslots immediately after mmu_notifiers are unregistered · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 06/10] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 07/10] KVM: WARN and reject guest-based uaccess if VM is dying · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 08/10] KVM: nVMX: Don't flush shadow VMCS12 to guest memory during vCPU teardown · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 01/10] KVM: Reject user accesses to guest memory if current->mm != kvm->mm · Sean Christopherson <seanjc@google.com> · 2026-10-01
Re: [PATCH v2 01/10] KVM: Reject user accesses to guest memory if current->mm != kvm->mm · James Houghton <hidden> · 2026-10-01
Re: [PATCH v2 01/10] KVM: Reject user accesses to guest memory if current->mm != kvm->mm · Sean Christopherson <seanjc@google.com> · 2026-10-01
Re: [PATCH v2 01/10] KVM: Reject user accesses to guest memory if current->mm != kvm->mm · James Houghton <hidden> · 2026-10-01
[PATCH v2 09/10] KVM: nVMX: Don't try to load eVMCS12 page when the VM is dying · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 02/10] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all() · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 10/10] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory · Sean Christopherson <seanjc@google.com> · 2026-10-01
[PATCH v2 03/10] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed · Sean Christopherson <seanjc@google.com> · 2026-10-01
Re: [PATCH v2 03/10] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed · James Houghton <hidden> · 2026-10-01
[PATCH v2 04/10] KVM: Disallow setting memslots when the VM is being destroyed · Sean Christopherson <seanjc@google.com> · 2026-10-01
[syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM · syzbot ci <hidden> · 2026-10-02
Re: [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM · Sean Christopherson <seanjc@google.com> · 2026-10-02

Re: [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM

From: Sean Christopherson <seanjc@google.com>
Date: 2026-10-02 20:39:32
Also in: kvm, lkml, syzbot

On Fri, Oct 02, 2026, syzbot ci wrote:

------------[ cut here ]------------
!__kvm_can_do_uaccess(kvm)
WARNING: ./include/linux/kvm_host.h:1360 at kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline], CPU#1: syz.1.18/5858
WARNING: ./include/linux/kvm_host.h:1360 at kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline], CPU#1: syz.1.18/5858
WARNING: ./include/linux/kvm_host.h:1360 at __kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226, CPU#1: syz.1.18/5858
Modules linked in:
CPU: 1 UID: 0 PID: 5858 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline]
RIP: 0010:kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline]
RIP: 0010:__kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226
Code: f2 ff ff ff 0f 44 d8 31 ff e8 5e a4 89 00 89 d8 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 09 ac a8 0a cc e8 83 9e 89 00 90 <0f> 0b 90 bb f2 ff ff ff eb da e8 73 9e 89 00 90 0f 0b 90 bb f2 ff
RSP: 0018:ffffc90003157778 EFLAGS: 00010293
RAX: ffffffff813e2d22 RBX: 0000000000000000 RCX: ffff888174382580
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff1102217d82a R08: ffff888110bee183 R09: 1ffff1102217dc30
R10: dffffc0000000000 R11: ffffed102217dc31 R12: ffff888110bee180
R13: ffff888174382b40 R14: 1ffff1102217dc30 R15: 0000000000000000
FS:  000055557c0db500(0000) GS:ffff8882a8cda000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f458dfeb840 CR3: 000000016c9d0000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 kvm_vcpu_read_guest+0x64/0x140 virt/kvm/kvm_main.c:3284
 nested_vmx_load_msr+0x133/0x4d0 arch/x86/kvm/vmx/nested.c:1107

Oh man.  vmx_leave_nested() is so broken.  If loading MSRs on nested VM-Exit is
broken (and it obviously is), then storing MSRs on nested VM-Exit is also broken,
i.e. there's at least a second case where nVMX can write to random process memory
on vCPU teardown (shadow vmcs12 being the other one).

It probably makes sense to go straight to open coding punting the vCPU out of L2
in vmx_leave_nested() instead of hack-a-fixing a bunch of flows.  I.e. replace
patch 8 and 9 with a proper fix.

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help