Re: [syzbot] [kvm?] WARNING in vmx_handle_exit (2)

[James Houghton]

On Wed, Feb 12, 2025 at 2:50 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> On Wed, Feb 12, 2025, James Houghton wrote:
> > Here's what I think is going on (with the C repro anyway):
> >
> > 1. KVM_RUN a nested VM, and eventually we end up with
> >    nested_run_pending=1.
> > 2. Exit KVM_RUN with EINTR (or any reason really, but I see EINTR in
> >    repro attempts).
> > 3. KVM_SET_REGS to set rflags to 0x1ac585, which has X86_EFLAGS_VM,
> >    flipping it and setting vmx->emulation_required = true.
> > 3. KVM_RUN again. vmx->emulation_required will stop KVM from clearing
> >    nested_run_pending, and then we hit the
> >    KVM_BUG_ON(nested_run_pending) in __vmx_handle_exit().
> >
> > So I guess the KVM_BUG_ON() is a little bit too conservative, but this
> > is nonsensical VMM behavior. So I'm not really sure what the best
> > solution is. Sean, any thoughts?
>
> Heh, deja vu.  This is essentially the same thing that was fixed by commit
> fc4fad79fc3d ("KVM: VMX: Reject KVM_RUN if emulation is required with pending
> exception"), just with a different WARN.
>
> This should fix it.  Checking nested_run_pending in handle_invalid_guest_state()
> is overkill, but it can't possibly do any harm, and the weirdness can be addressed
> with a comment.

Thanks Sean! This works, feel free to add:

Tested-by: James Houghton <jthoughton@xxxxxxxxxx>

I understand this fix as "KVM cannot emulate a nested vm-enter, so if
emulation is required and we have a pending vm-enter, exit to
userspace." (This doesn't seem overkill to me... perhaps this
explanation is wrong.)