Re: [PATCH 4/4] KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to KVM_BUG_ON()

[Yosry Ahmed]

On Wed, Aug 26, 2026 at 2:18 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> Bug the VM, not the host, if KVM's sanity check that walking guest PTEs
> doesn't underflow the walker's level fires.  Bugging the host while holding
> mmu_lock is all but guaranteed to panic the host, KVM hasn't _yet_ consumed
> the out-of-bounds level (i.e. hasn't corrupted memory), and KVM is already
> committed to bugging the VM and synthesizing a guest page fault if a fatal
> MMU error occurs while walking guest PTEs.  I.e. there's no reason to keep
> the BUG_ON() at this point.
>
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>

Reviewed-by: Yosry Ahmed <yosry@xxxxxxxxxx>

> ---
>  arch/x86/kvm/mmu/paging_tmpl.h | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
> index 46a0f7796e55..2cf5e733aba4 100644
> --- a/arch/x86/kvm/mmu/paging_tmpl.h
> +++ b/arch/x86/kvm/mmu/paging_tmpl.h
> @@ -392,7 +392,9 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
>                 offset    = index * sizeof(pt_element_t);
>                 pte_gpa   = gfn_to_gpa(table_gfn) + offset;
>
> -               BUG_ON(walker->level < 1);
> +               if (KVM_BUG_ON(walker->level < 1, vcpu->kvm))
> +                       goto error;
> +
>                 walker->table_gfn[walker->level - 1] = table_gfn;
>                 walker->pte_gpa[walker->level - 1] = pte_gpa;
>
> --
> 2.55.0.887.g758fc8c411-goog
>