[PATCH 0/4] KVM: x86/mmu: Don't sync cached roots created for a different MMU context

[Yosry Ahmed <yosry@kernel.org>]

When invalidating an address, KVM walks and syncs cached roots using the
current MMU context, but cached roots may have been created for a
different context after a nested transition.  With TDP disabled, this
lets a guest trigger a BUG_ON() and crash the host (see patch 3 for
details).

Patch 1 downgrades the BUG_ON() to a WARN_ON_ONCE(), patch 2 is prep
work, patch 3 is the fix, and patch 4 drops a TODO that isn't worth
pursuing.

Sashiko flagged the issue while reviewing the INVLPGA emulation patch in
my nested SVM TLB series [1].  The host crash is easy to reproduce with an
AI-generated repro (with TDP disabled), and no longer triggers with this
series.

[1] https://lore.kernel.org/kvm/sashiko-outbox-163479@kernel.org/

Yosry Ahmed (4):
  KVM: x86/mmu: WARN, don't BUG, when walking a cached root with a PAE
    MMU
  KVM: x86/mmu: Drop for_each_shadow_entry_using_root()
  KVM: x86/mmu: Don't sync cached roots created for a different MMU
    context
  KVM: nVMX: Drop the TODO to sync only the affected SPTEs for INVVPID

 arch/x86/kvm/mmu/mmu.c    | 76 ++++++++++++++++++++++++++++-----------
 arch/x86/kvm/vmx/nested.c |  2 --
 2 files changed, 55 insertions(+), 23 deletions(-)


base-commit: 6bd2905303c58679e303941b7d8ae8c074cd95ce
-- 
2.56.0.385.gd3acb90ef8-goog