[PATCH 1/4] KVM: x86/mmu: WARN, don't BUG, when walking a cached root with a PAE MMU

[Yosry Ahmed]

Replace the BUG_ON() in shadow_walk_init_using_root() that guards against
walking a cached (previous) root while the MMU is configured for PAE
paging with a WARN_ON_ONCE(), and terminate the walk if the WARN fires.
Walking a cached root with a PAE MMU is a KVM bug, as PAE roots are never
cached, but there's no need to bring down the host, as KVM can simply
bail from the walk.

Note, the BUG_ON() is currently reachable by a guest if TDP is disabled,
as KVM walks cached roots even if they were created for a different MMU
context, e.g. if L2 executes INVLPG while using PAE paging, L1 doesn't
intercept INVLPG, and L1's 64-bit root is cached.

Add a common error label for terminating the walk, and use it for the
existing invalid/dummy root check as well.

Fixes: 7eb77e9f5fcf ("kvm: x86: Add a root_hpa parameter to kvm_mmu->invlpg()")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Yosry Ahmed <yosry@xxxxxxxxxx>
---
 arch/x86/kvm/mmu/mmu.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index aadd5bdc2c97a..126faef5a6476 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2558,10 +2558,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
 	iterator->addr = addr;
 	iterator->shadow_addr = root;
 
-	if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root)) {
-		iterator->level = 0;
-		return;
-	}
+	if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root))
+		goto error;
 
 	iterator->level = vcpu->arch.mmu->root_role.level;
 
@@ -2575,7 +2573,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
 		 * prev_root is currently only used for 64-bit hosts. So only
 		 * the active root_hpa is valid here.
 		 */
-		BUG_ON(root != vcpu->arch.mmu->root.hpa);
+		if (WARN_ON_ONCE(root != vcpu->arch.mmu->root.hpa))
+			goto error;
 
 		iterator->shadow_addr
 			= vcpu->arch.mmu->pae_root[(addr >> 30) & 3];
@@ -2584,6 +2583,10 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
 		if (!iterator->shadow_addr)
 			iterator->level = 0;
 	}
+	return;
+
+error:
+	iterator->level = 0;
 }
 
 static void shadow_walk_init(struct kvm_shadow_walk_iterator *iterator,
-- 
2.56.0.385.gd3acb90ef8-goog