[PATCH 1/2] KVM: VMX: Clear vmx->fail before exiting to userspace on failed VM-Enter

[Sean Christopherson]

Clear vmx->fail before existing to userspace to report a failed VM-Enter
when trying to run L1 so that KVM doesn't consume what is effectively stale
information if userspace continues to utilize the vCPU, e.g. instead of
terminating the VM.

Specifically, if userspace forces the vCPU into L2 via KVM_SET_NESTED_STATE
without ever doing KVM_RUN again, the stale vmx->fail will trip the sanity
checks in the nested VM-Exit path that KVM didn't botch its consistency
checks and/or configuration of vmcs02.

Note, reworking nested_vmx_free_vcpu() to not abuse the nested VM-Exit path
would NOT fix this issue (even though that's highly desirable and necessary
for other reasons).  E.g. the reproducer just happened to let the VM die
after setting up the problematic scenario, it could just as easily have
forced the vCPU L2 out of L2 via any number of ioctls that flow through
vmx_leave_nested().

  WARNING: arch/x86/kvm/vmx/nested.c:5139 at __nested_vmx_vmexit+0x86a/0x890 [kvm_intel], CPU#76: repro/21553
  Modules linked in: kvm_intel kvm irqbypass vfat fat sha3 libsha3 gq(O) spidev cdc_acm xhci_pci xhci_hcd [last unloaded: kvm]
  CPU: 76 UID: 0 PID: 21553 Comm: repro Tainted: G S      W  O        7.3.0-smp--0767452329c33-seanjc-sink #5 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE
  Hardware name: Google LLC Indus/Indus_QC_03, BIOS 30.128.2 07/15/2026
  RIP: 0010:__nested_vmx_vmexit+0x86a/0x890 [kvm_intel]
  Call Trace:
   <TASK>
   nested_vmx_free_vcpu+0x36/0x50 [kvm_intel]
   vmx_vcpu_free+0x73/0x130 [kvm_intel]
   kvm_arch_vcpu_destroy+0x81/0x1a0 [kvm]
   kvm_destroy_vcpus+0x9d/0x160 [kvm]
   kvm_arch_destroy_vm+0x25/0x90 [kvm]
   kvm_put_kvm+0x342/0x460 [kvm]
   kvm_vm_release+0x29/0x30 [kvm]
   __fput+0xfe/0x280
   task_work_run+0x83/0xa0
   do_exit+0x23f/0x970
   do_group_exit+0xa3/0xb0
   __x64_sys_exit_group+0x17/0x20
   x64_sys_call+0x18c6/0x18d0
   do_syscall_64+0xfe/0x460
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

  WARNING: arch/x86/kvm/vmx/nested.c:5142 at __nested_vmx_vmexit+0x6c6/0x890 [kvm_intel], CPU#28: repro/21553
  Modules linked in: kvm_intel kvm irqbypass vfat fat sha3 libsha3 gq(O) spidev cdc_acm xhci_pci xhci_hcd [last unloaded: kvm]
  CPU: 28 UID: 0 PID: 21553 Comm: repro Tainted: G S      W  O        7.3.0-smp--0767452329c33-seanjc-sink #5 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE
  Hardware name: Google LLC Indus/Indus_QC_03, BIOS 30.128.2 07/15/2026
  RIP: 0010:__nested_vmx_vmexit+0x6c6/0x890 [kvm_intel]
  Call Trace:
   <TASK>
   nested_vmx_free_vcpu+0x36/0x50 [kvm_intel]
   vmx_vcpu_free+0x73/0x130 [kvm_intel]
   kvm_arch_vcpu_destroy+0x81/0x1a0 [kvm]
   kvm_destroy_vcpus+0x9d/0x160 [kvm]
   kvm_arch_destroy_vm+0x25/0x90 [kvm]
   kvm_put_kvm+0x342/0x460 [kvm]
   kvm_vm_release+0x29/0x30 [kvm]
   __fput+0xfe/0x280
   task_work_run+0x83/0xa0
   do_exit+0x23f/0x970
   do_group_exit+0xa3/0xb0
   __x64_sys_exit_group+0x17/0x20
   x64_sys_call+0x18c6/0x18d0
   do_syscall_64+0xfe/0x460
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

Reported-by: syzbot@xxxxxxxxxx
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---
 arch/x86/kvm/vmx/vmx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index b341af4c6057..29aa93cea963 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6756,6 +6756,7 @@ int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
 		vcpu->run->fail_entry.hardware_entry_failure_reason
 			= vmcs_read32(VM_INSTRUCTION_ERROR);
 		vcpu->run->fail_entry.cpu = vcpu->arch.last_vmentry_cpu;
+		vmx->fail = 0;
 		return 0;
 	}
 
-- 
2.56.0.257.gf7497c7d27-goog