[PATCH 0/2] KVM: VMX: Clear vmx->fail on exit to userspace

[PATCH 0/2] KVM: VMX: Clear vmx->fail on exit to userspace

[Sean Christopherson]

Clear vmx->fail before exiting to userspace to report a failed VM-Entry to
fix a splat triggered by syzkaller where the stale vmx->fail confuses the
force nested VM-Exit flow.  Found on a Google-internal kernel, but the
reproducer (will attach) works on upstream (but only on CPUs without CET,
because it generates a VM-Fail by injecting #UD with an error code).

Sean Christopherson (2):
  KVM: VMX: Clear vmx->fail before exiting to userspace on failed
    VM-Enter
  KVM: VMX: Dedup VM-Enter error handling for VM-Fail and VM-Exit

 arch/x86/kvm/vmx/vmx.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)


base-commit: 164405e8e9a0378c7e1aff2254625a6553a291f1
-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 1/2] KVM: VMX: Clear vmx->fail before exiting to userspace on failed VM-Enter

[Sean Christopherson]

Clear vmx->fail before existing to userspace to report a failed VM-Enter
when trying to run L1 so that KVM doesn't consume what is effectively stale
information if userspace continues to utilize the vCPU, e.g. instead of
terminating the VM.

Specifically, if userspace forces the vCPU into L2 via KVM_SET_NESTED_STATE
without ever doing KVM_RUN again, the stale vmx->fail will trip the sanity
checks in the nested VM-Exit path that KVM didn't botch its consistency
checks and/or configuration of vmcs02.

Note, reworking nested_vmx_free_vcpu() to not abuse the nested VM-Exit path
would NOT fix this issue (even though that's highly desirable and necessary
for other reasons).  E.g. the reproducer just happened to let the VM die
after setting up the problematic scenario, it could just as easily have
forced the vCPU L2 out of L2 via any number of ioctls that flow through
vmx_leave_nested().

  WARNING: arch/x86/kvm/vmx/nested.c:5139 at __nested_vmx_vmexit+0x86a/0x890 [kvm_intel], CPU#76: repro/21553
  Modules linked in: kvm_intel kvm irqbypass vfat fat sha3 libsha3 gq(O) spidev cdc_acm xhci_pci xhci_hcd [last unloaded: kvm]
  CPU: 76 UID: 0 PID: 21553 Comm: repro Tainted: G S      W  O        7.3.0-smp--0767452329c33-seanjc-sink #5 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE
  Hardware name: Google LLC Indus/Indus_QC_03, BIOS 30.128.2 07/15/2026
  RIP: 0010:__nested_vmx_vmexit+0x86a/0x890 [kvm_intel]
  Call Trace:
   <TASK>
   nested_vmx_free_vcpu+0x36/0x50 [kvm_intel]
   vmx_vcpu_free+0x73/0x130 [kvm_intel]
   kvm_arch_vcpu_destroy+0x81/0x1a0 [kvm]
   kvm_destroy_vcpus+0x9d/0x160 [kvm]
   kvm_arch_destroy_vm+0x25/0x90 [kvm]
   kvm_put_kvm+0x342/0x460 [kvm]
   kvm_vm_release+0x29/0x30 [kvm]
   __fput+0xfe/0x280
   task_work_run+0x83/0xa0
   do_exit+0x23f/0x970
   do_group_exit+0xa3/0xb0
   __x64_sys_exit_group+0x17/0x20
   x64_sys_call+0x18c6/0x18d0
   do_syscall_64+0xfe/0x460
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

  WARNING: arch/x86/kvm/vmx/nested.c:5142 at __nested_vmx_vmexit+0x6c6/0x890 [kvm_intel], CPU#28: repro/21553
  Modules linked in: kvm_intel kvm irqbypass vfat fat sha3 libsha3 gq(O) spidev cdc_acm xhci_pci xhci_hcd [last unloaded: kvm]
  CPU: 28 UID: 0 PID: 21553 Comm: repro Tainted: G S      W  O        7.3.0-smp--0767452329c33-seanjc-sink #5 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE
  Hardware name: Google LLC Indus/Indus_QC_03, BIOS 30.128.2 07/15/2026
  RIP: 0010:__nested_vmx_vmexit+0x6c6/0x890 [kvm_intel]
  Call Trace:
   <TASK>
   nested_vmx_free_vcpu+0x36/0x50 [kvm_intel]
   vmx_vcpu_free+0x73/0x130 [kvm_intel]
   kvm_arch_vcpu_destroy+0x81/0x1a0 [kvm]
   kvm_destroy_vcpus+0x9d/0x160 [kvm]
   kvm_arch_destroy_vm+0x25/0x90 [kvm]
   kvm_put_kvm+0x342/0x460 [kvm]
   kvm_vm_release+0x29/0x30 [kvm]
   __fput+0xfe/0x280
   task_work_run+0x83/0xa0
   do_exit+0x23f/0x970
   do_group_exit+0xa3/0xb0
   __x64_sys_exit_group+0x17/0x20
   x64_sys_call+0x18c6/0x18d0
   do_syscall_64+0xfe/0x460
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

Reported-by: syzbot@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/vmx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index b341af4c6057..29aa93cea963 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6756,6 +6756,7 @@ int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
 		vcpu->run->fail_entry.hardware_entry_failure_reason
 			= vmcs_read32(VM_INSTRUCTION_ERROR);
 		vcpu->run->fail_entry.cpu = vcpu->arch.last_vmentry_cpu;
+		vmx->fail = 0;
 		return 0;
 	}
 
-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 2/2] KVM: VMX: Dedup VM-Enter error handling for VM-Fail and VM-Exit

[Sean Christopherson]

Dedup the error handling code for failed VM-Entry as the only difference
between the VM-Fail and VM-Exit cases is the source of the failure reason.

Other than clearing vmx->fail on a VM-Exit failure, which should be a nop
absent other bugs, no functional change intended.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/vmx.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 29aa93cea963..a15cdad5c06a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6741,21 +6741,13 @@ int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
 	if (vmx->vt.emulation_required)
 		return handle_invalid_guest_state(vcpu);
 
-	if (exit_reason.failed_vmentry) {
+	if (exit_reason.failed_vmentry || unlikely(vmx->fail)) {
 		dump_vmcs(vcpu);
 		vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
-		vcpu->run->fail_entry.hardware_entry_failure_reason
-			= exit_reason.full;
+		vcpu->run->fail_entry.hardware_entry_failure_reason =
+			vmx->fail ? vmcs_read32(VM_INSTRUCTION_ERROR) : exit_reason.full;
 		vcpu->run->fail_entry.cpu = vcpu->arch.last_vmentry_cpu;
-		return 0;
-	}
 
-	if (unlikely(vmx->fail)) {
-		dump_vmcs(vcpu);
-		vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
-		vcpu->run->fail_entry.hardware_entry_failure_reason
-			= vmcs_read32(VM_INSTRUCTION_ERROR);
-		vcpu->run->fail_entry.cpu = vcpu->arch.last_vmentry_cpu;
 		vmx->fail = 0;
 		return 0;
 	}
-- 
2.56.0.257.gf7497c7d27-goog