Re: [PATCH 2/4] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has

[Yosry Ahmed]

On Wed, Aug 26, 2026 at 2:18 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> Extend the "EFER.LMA && !CR4.PAE" check, which exists largely to guard
> against KVM configuring a paging32 MMU with more than 2 levels of paging,

Is there value in keeping the original check? I suppose yes as you
said it exists "largely" for this, but it would probably be nice to
spell it out (if we know).

> with a very explicit check for exactly that: that KVM isn't trying to walk
> more levels of paging than the MMU template provides.  I.e. harden KVM
> against all bugs that would cause KVM to generates accesses beyond the
> bounds of guest_walker's arrays, regardless of how KVM ended up with the
> misconfigured MMU.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
>  arch/x86/kvm/mmu/paging_tmpl.h | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
> index 27427e7f22fa..46a0f7796e55 100644
> --- a/arch/x86/kvm/mmu/paging_tmpl.h
> +++ b/arch/x86/kvm/mmu/paging_tmpl.h
> @@ -368,13 +368,14 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
>         pte_access = ~0;
>
>         /*
> -        * Queue a page fault for injection if this assertion fails, as callers
> -        * assume that walker.fault contains sane info on a walk failure.  I.e.
> -        * avoid making the situation worse by inducing even worse badness
> -        * between when the assertion fails and when KVM kicks the vCPU out to
> -        * userspace (because the VM is bugged).
> +        * Queue a page fault for injection if any of the below assertions fail,
> +        * as callers assume that walker.fault contains sane info on a walk
> +        * failure.  I.e. avoid making the situation worse by inducing even
> +        * worse badness between when the assertion fails and when KVM kicks
> +        * the vCPU out to userspace (because the VM is bugged).
>          */
> -       if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm))
> +       if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm) ||
> +           KVM_BUG_ON(w->cpu_role.base.level > PT_MAX_FULL_LEVELS, vcpu->kvm))
>                 goto error;
>
>         ++walker->level;
> --
> 2.55.0.887.g758fc8c411-goog
>